Why are containers uniquely suitable for runtime security based on allow lists?

Containers are typically designed to run a specific application or service, meaning they have a limited and

well-defined set of processes. This makes it easier to implement and manage runtime security based on

allow lists, as any deviation from the expected processes can be quickly identified and mitigated.

Reference: Security best practices for container environments emphasize the use of allow lists to enforce

runtime security, leveraging the predictable nature of container processes.

Palo Alto Networks Container Security Guide