Container runtime security: seccomp, AppArmor, Falco
You restrict running containers at kernel level, cut escape risk with rootless Docker and user namespaces, and catch suspicious behaviour instantly with Falco.
Level 401 · 16 lessons · 15 practice labs
Lessons
The limits of isolation
- Container escape paths: socket, privilege, kernel
- Linux capabilities: which are dangerous and why
- Short task: rate the escape risk of five containers
Kernel restrictions
- seccomp profiles: filtering system calls
- Building an app-specific seccomp profile
- An AppArmor profile for Docker
- Narrowing writable space with a read-only root and tmpfs
- Short task: run a service with a custom seccomp profile
Running rootless
- User namespace remapping
- Setting up rootless Docker and its limits
- Hardening the Docker daemon: daemon.json
- Short task: move an app to rootless Docker
Detection and response
- Runtime detection with Falco
- Writing your own Falco rule
- Responding to a suspicious container: stopping it and collecting evidence
- Capstone: detect, contain and rebuild a compromised container
Practice labs
- Read a container’s capabilities and mounts: Extract the capability list, mounted paths and privileged flag with docker inspect.
- Rate the escape risk of five containers: Score and rank them by socket mount, privileged mode, dangerous capabilities and host namespace use.
- Fix the riskiest container’s configuration without breaking it: Determine by tracing which capability is truly needed, drop the rest, remove the socket mount and confirm the service works.
- See a call the default seccomp profile blocks: Try a blocked system call inside a container and relate the error to the default profile.
- Run a service with a custom seccomp profile: Record the system calls the service uses, write a profile allowing only those and show the service runs.
- Narrow writable space with an AppArmor profile for Docker and a read-only root: Write and load the profile, make the root read-only, provide writable paths with tmpfs and prove a write outside the profile is denied.
- Find who the container’s root is on the host: Compare the process’s host user ID with user namespace remapping on and off.
- Move an app to rootless Docker: Set up the rootless daemon, start the app and work around the low-port and volume ownership limits.
- Harden the Docker daemon with daemon.json: Disable inter-container communication, block privilege escalation by default, add log limits and user remapping, and test the effect of each setting.
- Read a Falco alert and find which rule fired: Extract the rule name, container and command from the alert output.
- Write your own Falco rule: Write a rule that catches a package manager running in the web container and test it by triggering it in your own lab.
- Tune a noisy rule with exceptions: Filter out the shell alert the health check triggers with a rule exception and show a real shell is still caught.
- Stop a suspicious container without deleting it: Pause the container, disconnect it from the network and preserve its state as evidence.
- Collect evidence from a suspicious container: Export the filesystem diff, process list and logs and record their hashes.
- Detect, contain and rebuild a compromised container: Start from the Falco alert, collect evidence, close the way in within the image, redeploy from a clean image and show the same behaviour is now blocked.
About this course
You restrict running containers at kernel level, cut escape risk with rootless Docker and user namespaces, and catch suspicious behaviour instantly with Falco.
What you will learn
- The limits of isolation
- Kernel restrictions
- Running rootless
- Detection and response
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.