Docker security
Image, runtime and network security.
Level 201 · 20 lessons · 18 practice labs
Lessons
Auditing
- Auditing running containers in Docker: You will learn to audit which user, privileges and mounts running Docker containers use, and to identify the risky ones.
- Auditing a Docker Compose project: You will learn to review a Docker Compose file line by line and find exposed ports, privileges and secrets.
- Catching security drift in Compose override files: You will find cases where override files reopen ports, privileges or debugging even though the main Compose file is secure.
- Short task: inventory the privileges and ports of a server’s containers
Surface and privilege
- Reducing published ports in Docker: You will understand the risk of publishing Docker container ports to the outside network, and learn to remove needless ones and bind the rest locally.
- Removing access to the Docker socket: You will understand why access to the Docker socket amounts to full control of the host, and how to remove it from containers.
- Docker read-only mounts and removing privileged mode: You will learn to make host directories given to Docker containers read-only and to remove privileged mode where it is not needed.
- Non-root worker users in Docker: You will learn why running the application in a Docker container as a limited user instead of root is safer, and how to set it up.
- Docker cap_drop, no-new-privileges and a read-only root filesystem: You will trim a container’s Linux capabilities, stop it from gaining privileges and run its root filesystem read-only.
- Short task: re-run a container with the least privilege it needs
Images and secrets
- Handling Docker runtime secrets properly: You will learn to provide secrets such as passwords and keys to Docker safely at runtime instead of baking them into images or environment variables.
- Keeping tokens out of builds with BuildKit secret mounts: You will pass a build token through a BuildKit secret mount and confirm with docker history that no trace remains in image layers.
- Docker image hygiene: pinned tags and secrets in history: You will learn to pin version tags on Docker images and to find and clean up secrets forgotten in an image's history.
- Scanning an image for known vulnerabilities with Trivy: You will scan a container image with Trivy, rank the findings by severity and reduce them by updating the base image.
- Short task: rebuild cleanly an image whose history holds a token
Networks and volumes
- Segmenting Docker service networks: You will learn to split Docker containers into separate networks so each service can talk only to the services it must.
- Keeping service boundaries on shared volumes: When several containers share a volume, you will make sure each service can write only to its own folder.
- Docker Compose secrets and healthchecks: You will learn to pass secrets safely in Docker Compose and to use healthchecks to watch that services are running properly.
- Short task: move the database onto a network only the app can see
Capstone
- Capstone: a Docker container security review for an application: Capstone: you audit a fictional company's Docker Compose-based application, fix the risks you find and write a short security summary.
Practice labs
- Inventory the privileges and ports of running containers: Use docker inspect to tabulate each container’s user, published ports and whether it is privileged.
- Audit a Compose project for security: List and fix privileged mode, socket mounts, open ports and plain passwords in a Compose file.
- Catch the security drift an override file introduces: Render the merged Compose configuration, find the privilege and mount the override file quietly adds and write a script that checks for it.
- Remove the unneeded published ports: Remove the host-published ports of the database and cache services and show the app still reaches them on the internal network.
- Remove the Docker socket mount and privileged mode: Move a monitoring container that mounts the socket to a read-only metrics source, drop the privileged setting and verify it works.
- Re-run a container with the least privilege it needs: Drop all capabilities, add back only what is needed, apply no-new-privileges and a read-only root filesystem, and solve writable paths with tmpfs.
- Find which user the container’s process runs as: Check the process user for three services and list those running as root.
- Switch a worker service to a non-root user: Set the user in the Compose file, fix volume ownership and show the worker keeps processing its queue.
- Solve low-port and volume ownership problems without going back to root: Make a service that listens on port 80 and writes to a shared volume run as an unprivileged user and justify the solution you used.
- See the password in an environment variable with docker inspect: Show the password can be read from the container configuration and state which services are affected.
- Deliver the password as a file with Compose secrets: Convert the environment variable to a Compose secret, make the app read it from the file and confirm it no longer shows in inspect output.
- Move a build-time token to a BuildKit secret mount: Show a registry token passed with ARG remains in the image history, switch to a secret mount and prove the history is clean.
- Find the unpinned image tags: List images used with latest or no tag across Compose files and Dockerfiles.
- Scan an image with Trivy and close the fixable vulnerabilities: Extract high and critical findings, update the base image and packages and show the difference with a rescan.
- Rebuild cleanly an image whose history holds a token: Extract the token from layer history, rebuild with multi-stage and secret mounts, remove the old image from the registry and rotate the token.
- Map which networks the services are attached to: List the networks in a Compose project and the services attached to each.
- Move the database onto a network only the app can see: Define an internal network, attach the database to it and show the front-end container can no longer reach it.
- Set service boundaries on a shared volume and add healthchecks: Split an arrangement where two services write to one volume using read-only mounts and subpaths, add healthchecks and write a security review for the application.
About this course
Image, runtime and network security.
What you will learn
- Auditing
- Surface and privilege
- Images and secrets
- Networks and volumes
- Capstone
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.