About
In this module of the Docker Security learning path, you pull together every control from the previous four units and prove they work against a realistic broken deployment. This docker hardening capstone gives you a deliberately misconfigured Ciberbots API stack on the nested Docker lab host. That stack combines the worst misconfigurations you studied earlier: a privileged container with the Docker socket mounted inside, secrets stored in environment variables, an unsigned image pulled from the registry, no seccomp profile, writable root filesystem, and no resource limits. Your job is to threat-model that stack against the OWASP Docker Top 10, apply layered hardening controls, re-run the offensive checks to confirm every prior escape path now fails, and deliver a post-action control map that ties each fix to the D-item it addresses. This is a capstone. You already know the individual controls from Docker Security Foundations, Docker Runtime Security and Hardening, Secure Delivery and Supply Chain, and Offensive Container Hacking. Here you combine them under time pressure against a stack that has multiple overlapping weaknesses, the way production systems fail in practice. Upon completion of the module, students will be able to: • Map a misconfigured Docker deployment against all ten OWASP Docker Top 10 items and assign severity ratings. • Apply defense-in-depth hardening: least-privilege runtime flags, socket removal, Cosign image verification, secrets file mounts, seccomp profiles, and resource limits. • Re-execute offensive container escape techniques and confirm each attack vector now returns a permission denied or equivalent failure. • Produce a structured control map that links each remediation to the threat model finding, with before and after evidence. Skills: `docker-threat-model`, `defense-in-depth`, `control-verification`, `engagement-reporting` Prerequisites: Docker Security Foundations, Docker Runtime Security and Hardening, Secure Delivery and Supply Chain, Offensive Container Hacking. Certifications aligned: CIS Docker Benchmark (host, daemon, images, runtime), OWASP Docker Top 10 (D01 through D10), NIST SP 800-190 (application container security), CompTIA PenTest+ (findings, reporting, remediation verification). For inquiries, please write us at https://www.darkrelay.com/cybersecurity-course-inquiry