The rapid adoption of container technology, DevOps practices, and microservices architectures are three of the key drivers of modern digital transformation. Whether deployed in the cloud, on-premises, or in hybrid environments, containerisation has proved advantageous in terms of scalability, portability, and continuous delivery. And at the centre of this movement sits Kubernetes.
High-profile organisations have been standardising on Kubernetes as their container orchestrator. Tinder announced it was migrating its infrastructure to Kubernetes, followed shortly by Twitter announcing its own move from Mesos to Kubernetes. The momentum is unmistakable—but so are the security challenges that come with it.
To understand trends in container and Kubernetes security and adoption, a survey was conducted with over 200 IT security and operations decision-makers in November 2018. A follow-up survey was then conducted in July 2019 with nearly 400 individuals across security, DevOps, and product teams. The findings below draw from both surveys and illustrate how rapidly the landscape is shifting.
Kubernetes Adoption Grew by 50% in the First Half of 2019
Kubernetes was originally built by Google, drawing on lessons learned from internal cluster management systems Borg and Omega. It was open-sourced in 2014 as a platform for automating the deployment, scaling, and management of containerised applications. Google later partnered with the Linux Foundation to form the Cloud Native Computing Foundation (CNCF), which now stewards the Kubernetes project.
An early and dramatic demonstration of Kubernetes’ scalability came in 2016 when Niantic launched Pokémon Go, built on Kubernetes and deployed on Google Container Engine. At launch, user demand in the US was approximately 50x the original estimate and 10x the worst-case projection. Thanks to Kubernetes’ horizontal scaling capabilities, Niantic was able to stabilise the service and successfully launch in Japan just two weeks later—despite Japan generating three times the US traffic load.
Since that milestone, Kubernetes adoption has accelerated significantly. In the November 2018 survey, 57% of respondents said they were using Kubernetes as their container orchestrator—already the leading choice over any other platform. By July 2019, that figure had climbed to 86%, representing a 50% relative increase in just six months.
While all major cloud providers now offer managed Kubernetes services—AWS EKS, Azure AKS, and Google GKE—a significant portion of users still opt for self-managed clusters. The primary motivation is flexibility: self-managed Kubernetes gives teams greater control and makes it easier to port workloads between environments without being locked into a specific managed offering.
Security Concerns Grow in Lockstep with Adoption
Security concerns remain one of the primary constraints on container and Kubernetes adoption. 2019 alone saw the discovery of several high-severity vulnerabilities, including a critical flaw in the runC container runtime, a Kubernetes privilege escalation vulnerability, a denial-of-service vulnerability, and additional issues identified as part of a CNCF-commissioned security audit. Tesla’s public cloud environment was famously compromised via an exposed, unsecured Kubernetes dashboard—a cautionary example of what inadequate container security can lead to.
Survey respondents most frequently cited inadequate investment in security as their biggest concern about their organisation’s container strategy. This reflects a broader challenge: moving to a containerised or microservices architecture introduces new attack surfaces and security considerations that traditional security tooling was not designed to address.
Organisations need dedicated security controls purpose-built for containers, Kubernetes, and microservices in order to meet security and compliance obligations. Unlike traditional waterfall development, modern CI/CD-based methodologies require that security controls be deeply embedded in the pipeline from the earliest stages—not bolted on at the end.
Shifting Left: Security Across the Container Lifecycle
Survey respondents identified runtime as the lifecycle phase they are most worried about. However, most practitioners also understand that runtime failures are frequently the downstream consequence of security gaps introduced during the build and deploy phases. More than half (57%) of respondents expressed greater concern about what happens during build and deploy than at runtime.
This reflects the growing industry consensus around “shifting left”—applying security practices earlier in the development lifecycle rather than waiting until deployment or runtime. Catching misconfigurations, vulnerable base images, or over-privileged containers during the build phase is far less costly than addressing them after an incident in production.
- Build phase: Scan container images for known CVEs, enforce base image policies, validate Dockerfiles for security misconfigurations.
- Deploy phase: Use admission controllers (e.g., OPA/Gatekeeper) to enforce pod security policies, RBAC rules, and network policies before workloads reach the cluster.
- Runtime phase: Monitor for anomalous process behaviour, unexpected network connections, and privilege escalations using runtime security tools.
Containers and Kubernetes Are Running Everywhere
One of the more striking findings is just how heterogeneous container environments have become. While 70% of respondents run at least some containers on-premises, 75% of that group are also running workloads in the cloud. This means that any viable security strategy must span both environments simultaneously.
By mid-2019, more than half of respondents (53%) were operating in hybrid mode, up from 40% at the end of 2018. In the same period, the proportion of organisations running containers exclusively on-premises nearly halved—dropping from 31% to 17%. Cloud-only deployments remained broadly steady over the same period.
On the cloud provider front, AWS continued to lead container deployments, followed by Azure. Google Cloud came in third but showed notable growth, increasing its share from 18% to 28% over just six months—reflecting the company’s significant investment in Kubernetes tooling and the appeal of GKE for Kubernetes-native workloads.
DevSecOps: More Than a Buzzword
Traditional security processes, when treated as a gate at the end of development, become a bottleneck in DevOps workflows. The increasing sophistication of threats facing containerised environments has elevated DevSecOps—the integration of security responsibilities directly into development and operations teams—from a theoretical concept to an operational necessity.
Survey data showed a notable jump in the number of respondents citing DevSecOps teams as the appropriate owners of container security programs. The effect was even more pronounced when filtering for respondents in dedicated security or compliance roles: 42% of those individuals viewed DevSecOps as the right organisational structure for running container security programs. This signals a meaningful shift in how security ownership is being distributed across the engineering organisation.
Final Thoughts
Despite real and growing security concerns, containerisation shows no signs of slowing. The operational advantages—development velocity, deployment efficiency, and the ability to scale workloads dynamically—are consistently outweighing the anxiety around security gaps.
The survey data underscores this momentum. The percentage of organisations running more than 50% of their containers in production grew from 13% to 22%—a 70% increase in just six months. Over the same period, those running fewer than 10% of containers in production fell from 52% to 39%.
The message for engineering and security teams is clear: treat security as a first-class concern throughout the entire container lifecycle—from build through deploy to runtime. Organisations that embed security controls into their CI/CD pipelines, enforce least-privilege principles in Kubernetes RBAC, and invest in runtime monitoring will be far better positioned than those treating security as an afterthought.
Unlocking the full benefits of cloud-native technologies requires protecting the full container lifecycle. In a world where 75% of global organisations are projected to run containerised workloads in production, securing that foundation is not optional—it is foundational.