Container Image Hardening Pipeline Vulnerability Scanning Policy Gates and Runtime Efficiency in Production Kubernetes

The adoption of containerized applications and Kubernetes has improved scalability but introduced significant security challenges such as vulnerable images and runtime risks. This study proposes a DevSecOps-based container image hardening pipeline that integrates vulnerability scanning, policy-as-code enforcement, and runtime monitoring within a Kubernetes environment. A risk-scoring mechanism is used to evaluate container images, and deployment decisions are enforced through automated policy gates. Experimental results show that the proposed system significantly reduces the deployment of high-risk images and improves overall security posture. However, it introduces moderate overhead in CPU usage, memory consumption, and deployment latency, indicating a security–performance trade-off. The study demonstrates that an integrated security pipeline is more effective than isolated security mechanisms for secure Kubernetes deployments.