About
In this module of the Docker Security learning path, you build the mental model that every later control depends on. These docker security foundations are where every runtime, supply-chain, and offensive control starts. Before you harden a container, lock down a daemon, or sign an image, you need to understand how Docker actually isolates workloads and where that isolation is thin. Containers share the host kernel. That single fact separates them from virtual machines and defines their attack surface. This module covers the Linux primitives behind container isolation (namespaces and cgroups), the Docker architecture and CLI, how images are built and shipped securely, and how containers communicate over Docker networks. You work against a nested Docker lab host, so every command you run targets a disposable engine inside your lab stack, never the underlying infrastructure. Upon completion of the module, students will be able to: • Explain the shared-kernel isolation model and articulate why container boundaries are weaker than VM boundaries. • Operate the Docker CLI to run, inspect, stop, and remove containers on the lab Docker host. • Author a Dockerfile that runs as a non-root user from a minimal base image and push it to a registry. • Map the network topology of a multi-container Compose stack and identify container-to-container exposure. Skills: `container-isolation-model`, `docker-cli-ops`, `secure-dockerfile`, `docker-network-map` Prerequisites: Cybersecurity 101 (Linux, networking basics) or equivalent professional Linux administration. Certifications aligned: CIS Docker Benchmark (images, runtime), NIST SP 800-190 (application container security), OWASP Docker Top 10 (D03, D04, D07). For inquiries, please write us at https://www.darkrelay.com/cybersecurity-course-inquiry