White Paper

WHITE PAPER Extending Mission Grade Protection to Containerized Workloads mrcy.com 3 Learn more Visit: mrcy.com Contact us The Mercury Systems logo is a registered trademark of Mercury Systems, Inc. Other marks used herein may be trademarks or registered trademarks of their respective holders. Mercury products identified in this document conform with the specifications and standards described herein. Conformance to any such standards is based solely on Mercury 's internal processes and methods. The information contained in this document is subject to change at any time without notice. © 2026 Mercury Systems, Inc. 8218.00E-0426-wp-RelianceOneForLinux MADE IN USA Corporate Headquarters 50 Minuteman Road Andover, MA 01810 USA +1 978.967.1401 tel +1 866.627.6951 tel +1 978.256.3599 fax International Headquarters Mercury International Avenue Eugène-Lance, 38 PO Box 584 CH-1212 Grand-Lancy 1 Geneva, Switzerland +41 22 884 51 00 tel When applied to container hosts, these capabilities lock down the container runtime configuration and enforce advanced application allowlisting. This dual approach constrains adversaries who might gain arbitrary code execution on the host while simultaneously preventing the execution of untrusted code within container images and image layers. These host protections are foundational to RelianceOne's approach to securing container workloads but represent just one layer of a holistic approach. Data-at-rest Protections and Intra-container Isolation RelianceOne leverages the same security capabilities used to protect the host and container runtime to provide comprehensive at-rest and runtime confidentiality and authenticity guarantees for container image contents. Through the innovative application of multi-stage builds and OCI (Open Container Initiative) hooks, RelianceOne enables FortiFS / AuthFS vaults and MAC policy to be seamlessly integrated into existing container images without requiring modifications to image formats or registry / orchestration infrastructure. This vault-based protection secures image and layer contents across three critical threat vectors: untrusted registry storage, compromised container hosts, and malicious or untrusted executables operating within containers themselves. By encapsulating sensitive components within authenticated and encrypted vaults, RelianceOne ensures that even if the adversary gains access to the registry, compromises the host system, or gains arbitrary execution within a container, they cannot access or tamper with protected contents. Integration with RelianceOne's key management API ensures that sensitive container workloads and mounted volumes are only accessible on specific, cryptographically verified runners. This binding between workloads and trusted infrastructure prevents unauthorized execution, data exfiltration, and reverse engineering, even if container images are copied to untrusted environments. Critically, this protection operates transparently; no special registry configurations, proprietary image formats, or workflow modifications are required. The result is a security model that preserves the full modularity, portability, and interoperability advantages of containerized applications while providing robust protection for sensitive data, software, cryptographic key material, API tokens, credentials, and proprietary intellectual property. With RelianceOne, organizations can confidently deploy containers knowing that their most valuable assets will remain protected from compromise, unauthorized modification, and reverse engineering throughout the entire container lifecycle.

• Cover