// Comparison

Container Security vs How to Hack Like a Ghost: Which Should You Read?

Two cybersecurity books on Cloud, compared honestly: who each is for, what each does best, and which to read first.

Intermediate

4/52020

Fundamentals for Securing Containerized Applications

Liz Rice

Liz Rice's first-principles introduction to how Linux containers actually work — namespaces, cgroups, capabilities, seccomp, image layering — and the security implications that fall out of those mechanics.

Intermediate

4/52021

How to Hack Like a Ghost

Breaching the Cloud

Sparc Flow

A narrated, real-time breach of a fictional data-driven political consulting firm's AWS and Kubernetes environment, written by a working penetration tester who presents at Black Hat and DEF CON.

Read this if

Engineers and security people who use containers daily but treat them as boxes. The book is the rare introduction that explains containers as compositions of Linux primitives rather than as a Docker-shaped product, and that is exactly what makes the security argument legible.

Pentesters and red teamers who want cloud-specific tradecraft (AWS, Kubernetes, anonymous attacker infrastructure, OPSEC) delivered as a readable narrative rather than a reference manual. The target is fictional; the vulnerabilities it exploits are patterns seen in real cloud environments.

Skip this if

Readers needing in-depth Kubernetes, supply-chain (SLSA, in-toto, Sigstore), or cloud-runtime-specific (Fargate, Cloud Run, ECS) coverage; pair with the Kubernetes books and current SLSA documentation. Also light on Wasm-runtime alternatives, which are an increasing fraction of the field.

Readers wanting a structured, chapter-by-chapter reference they can jump around in; the book is a continuous narrative from recon to full compromise, better read start to finish than dipped into. Beginners with no cloud or Linux fundamentals will struggle to keep pace.

Key takeaways

A container is not a box; it is a process with curated views of namespaces and resources, and most container vulnerabilities live in the gap between that mental model and the box mental model.
Capability dropping, read-only root filesystems, and seccomp profiles are not optional — Rice makes the case persuasively with concrete examples.
Image-supply-chain hygiene is half the security story; the book pre-dates SLSA but motivates it cleanly.

Treats attacker OPSEC and anonymous infrastructure as seriously as the exploitation itself, which most cloud-pentest material skips.
Walks a complete, realistic AWS and Kubernetes attack chain end to end rather than isolated techniques.
The narrative format keeps the tradecraft memorable in a way a reference manual rarely does — closer to Mr. Robot than to a lab manual.

How they compare

Container Security and How to Hack Like a Ghost are both rated 4/5 in our catalog. Pick by topic preference and reading style rather than by rating.

Both books target intermediate-level readers, so the choice is about topic, not difficulty.

Container Security and How to Hack Like a Ghost both cover Cloud, so reading them in sequence reinforces the same material from different angles.

Keep reading

Container Security

→ Alternatives to Container Security → What to read after Container Security