--- title: "Containers, Churn and A Changed Attack Surface" source: "https://wordpress-1075849-4005834.cloudwaysapps.com/blog/containers-churn-and-a-changed-attack-surface/" description: "Container churn resulting from container proliferation and ephemeral lifespan results in a changed enterprise attack surface that must be protected." --- [Technical Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/technical-blog/) # Containers, Churn and A Changed Attack Surface By [Christopher Liljenstolpe](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/liljenstolpe/) on Feb 19, 2018 • 2 min read Microservices and containers have recently seen tremendous widespread adoption, as evidenced by the near tripling of the [crowd](http://siliconangle.com/blog/2017/12/12/many-cloud-native-hands-try-make-light-work-kubernetes-kubecon-womenintech/) [attending](http://virtualizationreview.com/articles/2018/01/05/kubecon-and-cloudnativecon-2017-austin.aspx) KubeCon Austin in December. Enterprises are seeking the business benefits of rapid application innovation, while at the same time having to navigate a changed attack surface. Cloud native applications have more moving parts with new security implications, particularly around East-West network traffic and the potential for lateral movement. The containers and microservices that comprise a cloud native application architecture are dynamic and create a different attack surface. Containerized architectures have exponentially greater network churn when compared to traditional or VM-based architectures, and that churn is driven by two factors: container proliferation and container lifespan. - **Container Proliferation:**Monolithic and VM-based applications are relatively stable with few instances to protect while containerized applications use an order of magnitude more instances. A [recent survey](http://sysdig.com/blog/sysdig-docker-usage-report-2017/)of Docker deployments showed a median of ten containers per host, however some users went up to 95 containers per host. Ten containers per host means 10X the number of instances that IT security needs to watch compared to a monolithic application. - **Container Lifespan**: Containers and microservices-based applications running in containers are dynamic and usually ephemeral. For organizations running Docker, the typical [lifetime of a container is less than a day.](http://www.datadoghq.com/docker-adoption/) Compare that to traditional and cloud-based VMs that have an average lifespan of 23 days. This translates into around 25X shorter lifespan. When you combine 10X instances with a 25X shorter lifespan, you get 250X more network churn – which means 250x the number of workloads being created, IP addresses being dynamically assigned and advertised, workloads being destroyed and IP addresses being recycled. Traditional security solutions that grew up with less dynamic VM infrastructure struggle to adapt to this dramatically more dynamic and demanding environment.  IT Security shops strive to protect this new attack surface by controlling against lateral movement as well as dynamically enforcing policy to meet security and compliance mandates. Traditional IT Security approaches of custom automation and manual firewall provisioning were designed for an era before the dynamic requirements of cloud native applications. [Tigera Secure](https://wordpress-1075849-4005834.cloudwaysapps.com/tigera-products/compare-products/) was designed from the ground up for this churn and provides container-optimized security built on Zero Trust to defend against lateral movement threats in the cloud native world. [Products](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/products/) Add Tigera as a preferred source on Google to see more of our content in your search results. [![Add as a preferred source on Google](https://wordpress-1075849-4005834.cloudwaysapps.com/app/themes/tigera2021/dist/img/google-preferred-source-light.png)](https://www.google.com/preferences/source?q=tigera.io) ## Related posts [![The Rise of AI Agents and the Reinvention of Kubernetes: Ratan Tipirneni’s 2026 Outlook](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/12/The-Rise-of-AI-Agents-and-the-Reinvention-of-Kubernetes.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/2026-the-rise-of-ai-agents/) [Company Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/company-blog/) #### [The Rise of AI Agents and the Reinvention of Kubernetes: Ratan Tipirneni’s 2026 Outlook](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/2026-the-rise-of-ai-agents/) By [Tigera Team](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/marketingtigera-io/) on Dec 30, 2025 Prediction: The next evolution of Kubernetes is not about scale alone, but about intelligence, autonomy, and governance. As part of the article ‘AI and Enterprise Technology Predictions from Industry Experts for 2026′, published by Solutions... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/2026-the-rise-of-ai-agents/) [![How Istio Ambient Mode Delivers Real World Solutions](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/12/How-Istio-Ambient-Mode-Delivers-Real-World-Solutions.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/how-istio-ambient-mode-delivers-real-world-solutions/) #### [How Istio Ambient Mode Delivers Real World Solutions](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/how-istio-ambient-mode-delivers-real-world-solutions/) By [John Alexander](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/john-alexander/) on Dec 18, 2025 For years, platform teams have known what a service mesh can provide: strong workload identity, authorization, mutual TLS authentication and encryption, fine-grained traffic control, and deep observability across distributed systems. In theory, Istio checked all... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/how-istio-ambient-mode-delivers-real-world-solutions/) [![A Detailed Look at the Calico Ingress Gateway](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/11/Blog-A-Detailed-Look-at-the-Calico-Ingress-Gateway.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/a-detailed-look-at-the-calico-ingress-gateway/) #### [A Detailed Look at the Calico Ingress Gateway](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/a-detailed-look-at-the-calico-ingress-gateway/) By [John Alexander](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/john-alexander/) on Nov 20, 2025 The Kubernetes community recently announced that Ingress NGINX, one of the most widely used Ingress controllers, will be retired. This change means teams need to plan for a secure, modern, and future-proof alternative for managing... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/a-detailed-look-at-the-calico-ingress-gateway/)