Luca BertonEN 304 635 covers hypervisors and container runtime systems — classified as Important Class II, requiring mandatory third-party conformity assessment. If you build or commercially distribute container infrastructure, this is your standard.
What EN 304 635 Covers
Container runtimes (containerd, CRI-O, Docker Engine), hypervisors (KVM, VMware ESXi, Hyper-V), and commercial Kubernetes distributions (OpenShift, Rancher, Tanzu) when sold as products.
Security Requirements Specific to Container Infrastructure
- Workload isolation — Containers must provide effective isolation. Namespace isolation, seccomp profiles, AppArmor/SELinux policies as defaults
- Image integrity — Support for image signing and verification (Notary/cosign). Reject unsigned images by default
- Runtime protection — Detection and prevention of container escape attempts, privilege escalation, and resource abuse
- Network segmentation — Default-deny network policies. Pod-to-pod encryption (mTLS via service mesh)
- Supply chain security — Base image provenance, build pipeline attestation (SLSA), minimal base images
- Secrets management — Encrypted secrets storage, rotation support, no plaintext secrets in manifests
Kubernetes Recipes
A practical guide for container orchestration and deployment by Grzegorz Stencel & Luca Berton (Apress).
Watch on Skillshare →Impact on Platform Engineering Teams
If you're using a commercial Kubernetes distribution, your vendor must achieve EN 304 635 conformity. But your configuration of that platform matters too:
- Are you running with Pod Security Standards enforced?
- Are admission controllers blocking non-compliant workloads?
- Is your image registry scanning and signing integrated?
- Do you have runtime security monitoring (Falco, Tetragon)?
The vendor provides a CRA-compliant product. You must deploy it in a CRA-compliant configuration. Your infrastructure partner helps bridge that gap.