Container Hardening

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R25 — Docker Security: non-root, capabilities, read-only FS

   R36 — Trivy/Grype image scanning

   R10 — OWASP Secrets Management & SSRF Cheat Sheets

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Harden all project Dockerfiles and Compose services: run as non-root user, drop Linux capabilities (cap_drop: ALL), enable read_only root filesystem with bounded tmpfs, pin base image digests, and disable privileged mode.

   Configure runtime secrets injection and strict outbound network egress rules. *Lab:* Prove secrets do not appear in docker inspect/image layers or logs, and test that unauthorized outbound connections from the container are blocked.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   No separate task text for this block on day 41 — the sourced work sits in the block above. Keep the time box.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Container hardening checklist, image scan output, and egress-denial test results.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R10OWASP Cheat Sheet Series↗ cheatsheetseries.owasp.org

  Authorization, SQL Injection Prevention, File Upload, SSRF, Secrets Management, and Logging Cheat Sheets.

• R25Docker Security Docs↗ docs.docker.com

  Daemon surface, Linux namespaces/capabilities, rootless/non-root containers, read-only FS, and secrets.

• R36Syft, Grype & Trivy (SBOM)↗ anchore.com

  CycloneDX/SPDX SBOM generation, container image scanning, dependency vulnerability detection, and scanner limits.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsOWASP · ~25 min read
  Docker Security - OWASP Cheat Sheet Series

  Rules for `--cap-drop all`, `--read-only` with tmpfs, no `--privileged`, read-only socket mounts and secrets management — a direct checklist for the compose rewrite.

  R25checked 2026-11-11
• videoCodeLucky · ~10 min
  🛡️ Docker Security: Running Containers as Non-Root User - Best Practices

  Shows creating an unprivileged user and enforcing it at runtime, including how to verify the effective UID from outside the container.

  R25checked 2026-11-11
• videoOtherDevOpsGene · ~8 min
  Syft and Grype demo- SBOM and container vulnerability scanning

  Generates a CycloneDX SBOM with Syft and then scans it with Grype, the R36 workflow for proving what is actually inside the pinned image digest.

  R36checked 2026-11-11
• articleSafeguard · 5 min read
  Docker Security Pro Tips: Hardening Beyond the Basics

  Goes past non-root into read-only rootfs with bounded tmpfs, `no-new-privileges`, resource bounds and the docker.sock trap, with a control-per-flag checklist table.

  R10checked 2026-11-11
• docsDocker Docs · ~10 min read
  Base image hardening

  Explains what to strip from a base image (shell, package manager, compilers) and why digest-pinned minimal bases shrink the surface an egress-escaping process can use.

  R25moved 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.