Auditing container and orchestration boundaries
You learn how container isolation works; you find and remove privileged containers, mounted docker.sock, host-path mounts and excess capabilities, scan images, audit Kubernetes permissions and set up runtime detection.
Level 401 · 17 lessons · 15 practice labs
Lessons
Boundaries
- Container isolation: namespaces, cgroups and capabilities
- The container threat model: image, runtime, host
- Short task: list the containers on the host and their settings
Runtime audit
- Finding and removing privileged containers
- docker.sock mounted into a container: why it is risky and how to remove it
- Auditing host-path mounts
- Dropping capabilities and a seccomp profile
- Rootless containers and user namespaces
- Short task: fix three misconfigured containers
Images and configuration
- Image vulnerability scanning: Trivy
- Secrets forgotten in images
- Auditing the host with Docker Bench
- Short task: scan an image, slim it and strip out secrets
Orchestration
- Auditing Kubernetes role bindings
- Pod security standards
- Runtime detection: introduction to Falco rules
- Capstone: audit and harden a container host and cluster
Practice labs
- List the containers on the host and their settings: Put each container's image, user, mounts and capabilities into one table.
- Draw a threat model for the container environment: Tabulate risks at image, runtime and host layers with examples from the lab.
- Verify containers' namespace and cgroup limits: Find containers sharing host namespaces or lacking resource limits and write the fix.
- Find the privileged container and remove the privilege: Find the container running privileged, restart it with only the needed capability and verify it works.
- Remove a docker.sock mounted into a container: Find the container mounting the socket, meet its need another way and confirm it runs without it.
- Fix three misconfigured containers: Fix a host directory mount, excess capabilities and root user, add a seccomp profile and re-audit.
- Scan an image and report critical findings: Scan the image with Trivy and list critical and high findings that have fixes.
- Find secrets left in image layers: Find keys and passwords left in layer history and files and rebuild the image without them.
- Slim an image, scan it and clean out secrets: Move Narçiçeği Eczaneleri's image to a small base, add a non-root user and show the drop in findings.
- Audit the host with Docker Bench: Group the audit warnings by section and choose the first five fixes.
- Harden Docker daemon settings and re-audit: Adjust user namespace, logging and network settings, restart the daemon and show fewer warnings.
- Test moving to a rootless container runtime: Run a service on a rootless runtime and verify its function and the host user mapping.
- Audit Kubernetes role bindings: List cluster-wide role bindings granting broad rights and remove the unneeded one.
- Apply a pod security standard to a namespace: Apply the restricted standard to a namespace, fix the non-compliant pod and confirm redeployment is accepted.
- Catch suspicious container behaviour with a Falco rule: Enable a rule that catches an interactive shell in a container, generate a test event and report the alert.
About this course
You learn how container isolation works; you find and remove privileged containers, mounted docker.sock, host-path mounts and excess capabilities, scan images, audit Kubernetes permissions and set up runtime detection.
What you will learn
- Boundaries
- Runtime audit
- Images and configuration
- Orchestration
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.