“Thin OS” Security for Container Hosts

Executive summary: This report advocates running containers on dedicated hosts with minimal ('thin') Linux distributions to reduce attack surface, leverage immutability and orchestrator-enforced access, and simplify security. It recommends applying CIS/NIST hardening and continuous monitoring, and describes how Aqua's platform can perform CIS benchmark checks, host vulnerability scanning, and audit logging to protect thin OS container hosts.