Docker Security Lab
Scan container images for CVEs, build minimal secure images, and enforce runtime security policies across a multi-container stack.
01 Overview
Containers are everywhere in modern infrastructure — and misconfigured containers are one of the top attack vectors. In this mission you'll learn to scan images for known vulnerabilities, build hardened Docker images using multi-stage builds and minimal base images, configure container runtime security with resource limits and read-only filesystems, and detect suspicious runtime behaviour with Falco.
02 Environment Setup
Install Docker: `curl -fsSL https://get.docker.com | sh` then `sudo usermod -aG docker $USER` and log out/in. Install Trivy: `sudo apt install wget && wget https://github.com/aquasecurity/trivy/releases/latest/download/trivy_Linux-64bit.deb && sudo dpkg -i trivy_Linux-64bit.deb` Verify with `docker --version && trivy --version`.
03 Mission Tasks
Use Trivy to scan a set of provided Docker images. Identify critical and high CVEs, document them, and propose remediation strategies.
Rewrite a provided Dockerfile using a distroless base image, multi-stage build, non-root user, and read-only filesystem.
Configure Docker Compose with security options: drop Linux capabilities, set memory/CPU limits, mount filesystems read-only, and disable privilege escalation.
Define custom Docker networks to isolate containers. Verify that only intended services can communicate with each other.
Install Falco and write custom rules to detect shell spawning inside containers, unexpected file writes, and privilege escalation attempts.
04 Why This Matters
Container security expertise is in high demand. Cloud Security Engineers and DevSecOps roles at every major company require hands-on Docker and Kubernetes security skills.
You'll Need
- Docker and Docker Compose installed
- Basic Docker knowledge (pull, run, build)
- Linux system (Ubuntu/Debian recommended)
- At least 4GB of free RAM
Tools & Tech Stack
Skills You'll Gain
- Container security
- Vulnerability scanning
- Image hardening
- Runtime threat detection
- Network segmentation
More Missions
Linux Hardening Fundamentals
Secure a fresh Ubuntu server from scratch — configure SSH, set up firewalls, manage users, and eliminate attack surface.
Cloud Security Audit with AWS
Audit a misconfigured AWS environment — find exposed S3 buckets, overly permissive IAM roles, open security groups, and missing CloudTrail.
Automated Threat Detection Pipeline
Build a SIEM-style detection pipeline using Python and the ELK stack to ingest logs, detect anomalies, and trigger automated alerts.