Introduction to container security: Docker
You learn step by step how a container differs from a virtual machine, what its isolation rests on and the most common security mistakes in Docker images.
Level 101 · 16 lessons · 15 practice labs
Lessons
What a container is
- Containers and virtual machines: sharing one kernel
- The basis of isolation: namespaces and cgroups
- Images and layers: looking inside an image
- The Docker daemon and its socket: who counts as admin
- Short task: find files left behind in an image’s layers
A safe image
- Choosing a trusted base image and pinning its version
- USER in a Dockerfile: running without root
- Keeping secret files out of the image with .dockerignore
- Your first image scan: seeing known vulnerabilities
- Short task: fix a flawed Dockerfile and scan it again
Running safely
- Publishing ports carefully: 0.0.0.0 versus 127.0.0.1
- Why --privileged is dangerous
- Memory, CPU and process limits
- Reading and keeping container logs
- Short task: run a service with limited privileges and resources
Capstone
- Capstone: move a small web app into a safe container
Practice labs
- Inspect an image’s layers and history: List the layers with docker history and state which instruction created the largest one.
- Find the file left behind in an image’s layers: Recover a config file that appears deleted in a later layer by exporting the image and reading the earlier layer.
- Prove what a container shares with the host: Collect three pieces of evidence from namespaces and cgroup settings that the kernel is shared while process and network views are separate.
- Add an unprivileged user to a Dockerfile: Add a USER line, rebuild the image and confirm the process is not root.
- Move the base image to a trusted source and a pinned version: Switch a Dockerfile using the latest tag to an official, version-pinned base image and keep secret files out with .dockerignore.
- Fix a flawed Dockerfile and scan it again: Remove the root user, the embedded password, the unpinned base and unneeded packages, scan the image and report the drop in vulnerabilities.
- Scan an image and count the critical vulnerabilities: Scan the image with Trivy and write the vulnerability counts by severity.
- Separate vulnerabilities that have a fix from those that do not: Filter the scan output to findings with a fixed version and show how many close when the base image is updated.
- Compare two base images by vulnerabilities and size: Build the same app on a full and a slim base image, scan both and explain with numbers which you choose.
- Publish a port on the loopback address only: Move a port published on every interface to 127.0.0.1 and show it is unreachable from outside.
- Put memory, CPU and process limits on a container: Restart an unlimited service with limits and verify with docker stats that they apply.
- Re-run a service from privileged mode with least privilege: Work out what a container started with --privileged truly needs, run it with only that capability and verify it still works.
- Read container logs and check the retention setting: Find the service’s latest error record and state whether the log driver has a size limit.
- Audit who can reach the Docker socket: Find the members of the docker group and the containers mounting the socket, and remove the unneeded access.
- Move a small web app into a safe container: Build an image that runs with an unprivileged user, pinned base, limits and a local port, scan it and show the app responds.
About this course
You learn step by step how a container differs from a virtual machine, what its isolation rests on and the most common security mistakes in Docker images.
What you will learn
- What a container is
- A safe image
- Running safely
- Capstone
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.