Have you even looked at the guidance? There's not anything nefarious here. Just imminently reasonable stuff like: "By default, many container services run as the privileged root user, and applications execute inside the container as root despite not requiring privileged execution. Preventing root execution by using non-root containers or a rootless container engine limits the impact of a container compromise. Both methods affect the runtime environment significantly, so applications should be thoroughly tested to ensure compatibility."

They then provide an example Dockerfile in an Appendix.

I've looked through NSA hardening guides for AD, Linux, and many other technologies. They're helpful and imminently reasonable.

Do the NSA and CIA do dirty things? Yes. Should you trust everything they do? No. But you probably should at least skim the hardening document before you completely dismiss it because of your distrust.

Or don't even bother to read the document. Just look at the works cited section, which tells you a lot about the content of the article. Works are cited from: Center for Internet Security, Defense Information Security Agency, Linux Foundation, MITRE ATT&CK, Cybersecurity and Infrastructure Security Agency, Kubernetes.

The guide talks about the following:

- Scanning containers for vulnerabilities and misconfigurations - Running Pods with least privilege - Use network segmentation to limit blast radius - Use firewalls - Use strong authN and authZ - Capture and monitor logs - Periodically check your configurations and do vuln scans

It then points to CIS Kubernetes benchmarks, Kubernetes Security Technical Implimentation Guide, and CISA.

Where's the boogey man?

CISA, not CIA. And their mission is to protect critical domestic infrastructure.

The sibling comments explain why the link contains sound advice, so I'll just add this: you are ultimately responsible for the security of your Kubernetes cluster, whether you get your hardening tips from william1964 on Stack Overflow, or the NSA.

Most of this guidance can be checked over by anyone with basic competency in the field, and cross referenced against documentation - in general a lot of the guidance from government security agencies is focused on solid and robust design principles (isolating things, not reusing things, turning off specific functionality that exposes risky attack surfaces, being aware of unusual or non obvious defaults).

Not running containers as root is accepted by pretty much everyone I'm aware of as a 'good move. Same for building images carefully and preventing filesystem changes at runtime. Same goes for using sandboxing, syscall filtering etc.

This is a bit different from giving you a series of black box parameters and telling you to blindly rely on them. (And even then, DES being hardened against differential cryptography shows that's not always a bad thing, though more recent examples show the opposite can also happen).

Yes, Black Hats know about security.

Yes. While many agencies have a bad reputation post-Snowden, CISA and NSA have for many years - and will continue to release hardening guides that are invaluable to security engineers.