Runtime security picks up once your containers are live, watching every system call, network packet and file change to stop zero-day exploits, insider moves or post-breach behavior. Pre-deployment scans only catch known CVEs; they won’t spot a new kernel exploit or someone injecting code via a misconfigured API. You need deep visibility into syscalls and processes to catch real-time attacks—from a stolen service account hopping east-west across pods to a cryptominer silently draining CPU cycles. Cilium’s Tetragon uses eBPF in the Linux kernel to intercept and enforce policies at the lowest level. Instead of parsing logs after the fact, it tags events with pod, namespace and deployment metadata—so “PID 4052 ran bash” becomes “frontend pod in production ran bash.” You can block a malicious syscall or kill a process the moment it violates a rule. The guide moves on to common runtime threats: container escapes via kernel flaws or over-privileged mounts, lateral movement across a flat cluster network, resource abuse like cryptomining, data exfiltration over DNS tunnels and dormant supply-chain implants. It argues that shared kernels and cgroups don’t stop in-memory attacks or syscall abuse, and Kubernetes RBAC won’t catch data-plane moves. You need an active, identity-aware shield in production.