About
In this module of the Docker Security learning path, you apply docker runtime security controls to defend the container while it runs. A well-built image can still be launched insecurely, and most real-world compromises start from runtime misconfiguration rather than exotic exploits: a privileged flag left on, an excess Linux capability, a process running as root, or a database password leaked through an environment variable. The lab seeds a deliberately over-privileged Ciberbots API container on the nested Docker host. You will strip it down to least privilege, enforce kernel-level access control with Seccomp and AppArmor, audit the environment against the CIS Docker Benchmark, and rotate secrets out of environment variables into file-based mounts. Cosign image signing is introduced as the current integrity control; Docker Content Trust is noted only as a historical CIS reference. The full Cosign workflow is covered in Secure Delivery and Supply Chain. Upon completion of the module, students will be able to: • Identify dangerous runtime settings (privileged flag, excess capabilities, root user, leaked secrets, writable filesystem, missing resource limits) and remediate them with least-privilege flags. • Drop all Linux capabilities and add back only the few a service needs, and explain what each removed capability prevented. • Write and apply a Seccomp system-call filter that blocks specific escape-class syscalls, and describe how AppArmor confines container file access. • Run Docker Bench for Security against the nested lab engine, interpret the report categories, and plan remediation. • Rotate secrets from environment variables to file or tmpfs mounts, and explain why daemon socket access is equivalent to host root. Skills: `runtime-least-privilege`, `mac-profiles`, `cis-docker-bench`, `secrets-daemon-harden` Prerequisites: Docker Security Foundations (namespaces, cgroups, Docker CLI, image builds, container networking). Certifications aligned: CIS Docker Benchmark (host, daemon, images, runtime, container sections), OWASP Docker Top 10 (D02, D04, D05, D07, D09), NIST SP 800-190 (runtime and orchestration controls). For inquiries, please write us at https://www.darkrelay.com/cybersecurity-course-inquiry