StackRox is an enterprise container security platform designed specifically for Kubernetes. It protects cloud-native applications across their entire lifecycle: Build, Deploy, and Runtime.

The platform was originally created by an independent company called StackRox, which pioneered the concept of “Kubernetes-native security.” In 2021, Red Hat acquired StackRox. Today, it is available under two names:

• StackRox: The upstream, open-source community project.
• Red Hat Advanced Cluster Security for Kubernetes (RHACS): The fully supported enterprise commercial product packaged by Red Hat.

No matter which name you see, the underlying technology is exactly the same, and it can protect standard Kubernetes clusters (like AWS EKS, Azure AKS, or Google GKE) just as easily as it protects Red Hat OpenShift.

What Makes StackRox Unique? (Kubernetes-Native Architecture)

Traditional container security platforms rely on generic Linux host agents that sit in the background on your servers, unaware of what Kubernetes is doing.

StackRox takes a completely different approach. It deploys lightweight components inside your cluster data plane, interacting directly with the Kubernetes API, Admission Controllers, and network fabric. Because it “speaks” native Kubernetes language, it uses the cluster’s own declarative data objects (like namespaces, deployments, and service accounts) to monitor, analyze, and enforce security policies. This approach provides deep visibility into your applications without introducing performance overhead.

The Core Capabilities of StackRox

StackRox divides its security enforcement into three operational stages to achieve true DevSecOps (“shifting security left”):

1. Build Phase: Image & Vulnerability Management

StackRox stops security risks before code ever reaches a server.

• It integrates with your CI/CD pipelines (Jenkins, GitHub Actions, Tekton) to scan container image layers for known vulnerabilities (CVEs) and malicious software packages.
• It acts as an automated quality gate, giving you the ability to fail a developer’s build pipeline if their application contains unpatched, high-severity vulnerabilities.

2. Deploy Phase: Cluster Hardening & Policy Guardrails

Before a container is permitted to run, the StackRox Admission Controller evaluates the deployment manifests against enterprise standards.

• It automatically calculates a Risk Score for every application by assessing multiple variables: Does it have root execution privileges? Is its file system writable? Is it exposed to the open internet?
• If a configuration is unsafe—for example, if a developer accidentally attempts to deploy a pod with privileged: true—StackRox will intercept and block the deployment request from completing.

3. Runtime Phase: Active Threat Detection

Once your applications are live in production, StackRox continuously monitors them for suspicious activity.

• It builds a “process baseline” of healthy container behavior. If an application suddenly attempts to launch an unexpected shell script, execute network reconnaissance tools (netcat), or run unauthorized code, StackRox detects the anomaly instantly.
• It can execute immediate remediation actions, such as alerting your response team or automatically terminating the compromised pod.

4. Key Structural Features

• Automated Network Policy Generator: StackRox tracks the live traffic patterns moving between your microservices, builds a visual graph of those data streams, and writes the YAML code needed to lock down your network into a secure, Zero-Trust posture.
• Continuous Compliance Auditing: Out of the box, StackRox continuously scans your cluster configurations and maps your infrastructure posture against major regulatory frameworks like PCI-DSS, HIPAA, NIST SP 800-190, and the CIS Benchmarks.

Component Architecture Overview

When you install StackRox, it deploys via a modular, micro-service footprint:

Component	Location	Responsibility
Central	Main Control Plane (Hub)	Stores security data, handles API interactions, and renders the central visual dashboard.
Scanner	Main Control Plane (Hub)	Regularly pulls down upstream vulnerability databases to scan image layers for CVEs.
Sensor	Target Cluster (Spoke)	The controller that tracks cluster state, enforces admission control, and reports back to Central.
Collector	Every Node (DaemonSet)	A lightweight service that monitors container runtime processes and live network activity at the OS level.