Cloud › Module 6 › Lesson 1
Docker Hygiene
Docker hygiene literacy — non-root user, read-only rootfs, minimal base image, no secrets in layers — on YOUR `$CLOUD_LAB` local Docker only.
Visual · t31_docker_hygiene
Docker hygiene = named container hardening rows. $CLOUD_LAB local Docker. Original Cyberlium.
Opening
Containers multiply misconfigurations fast — learn Docker hygiene on YOUR local lab before touching stranger registries or prod clusters.
Docker hygiene literacy names: run as non-root user category, read-only root filesystem category, minimal base image (distroless/alpine literacy), no secrets baked into image layers, pin image digests category, and drop unnecessary capabilities category. Analyst documents hygiene checklist on `$CLOUD_LAB` local Docker host or instructor stub Dockerfile — labels YOUR account and lab namespace — without scanning stranger registries, without pushing to employer prod ECR without RoE, without `--privileged` on shared clusters. Cyberlium on `$CLOUD_LAB`: your labeled compose stack under $HOME/cyberlium-lab/t31-cloud/. Refused: stranger tenant Docker API, prod image push without ticket, privileged container as default. Lab row: five hygiene controls with pass/fail stub on one lab Dockerfile. chmod 600 under $HOME/cyberlium-lab.
1. Named hygiene controls
Non-root, read-only rootfs, minimal base, no layer secrets, digest pin — five literacy anchors.
Each control maps to a Dockerfile or compose row you can verify on YOUR lab host.
Command guide
Try these commands — Named hygiene controls
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Optional command
Docker security — https://docs.docker.com/engine/security/
CIS Docker benchmark — https://www.cisecurity.org/benchmark/docker (literacy) OWASP Docker — https://owasp.org/www-project-docker-top-10/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install docker.io # or Docker Engine docs
macOS:
Command — copy this
brew install --cask docker
Windows: Install Docker Desktop
═══ LINUX / macOS ═══
Command — copy this
export CLOUD_LAB=${CLOUD_LAB:-$HOME/cyberlium-lab/t31-cloud}
cat > "$CLOUD_LAB/containers/docker-hygiene-checklist.md" <<'EOF'
# Docker Hygiene — YOUR images/containers only
- [ ] Run as non-root user in Dockerfile
- [ ] Read-only root filesystem where possible
- [ ] No secrets in image layers or ENV
- [ ] Pin base image digests, not floating tags
- [ ] Drop capabilities; no --privileged in prod
- [ ] Resource limits (CPU/memory)
HARD BAN: container escape PoCs against any cluster
EOFYOUR images — list local containers
Command — copy this
docker ps -a 2>/dev/null || echo 'Docker not running — review checklist offline' grep -E 'non-root|HARD BAN|privileged' "$CLOUD_LAB/containers/docker-hygiene-checklist.md"
Primary tools to practice this lesson: docker, grep. Reference sites: Docker security (https://docs.docker.com/engine/security/); CIS Docker benchmark (https://www.cisecurity.org/benchmark/docker); OWASP Docker (https://owasp.org/www-project-docker-top-10/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Lab Dockerfile discipline
Label `$CLOUD_LAB` source; separate sample stub from live lab build.
Scan Dockerfile for ENV secrets and latest tag drift — document UTC review.
3. $CLOUD_LAB boundary
Local Docker on YOUR machine or instructor stub only — not stranger tenant APIs.
Refused: prod registry push without RoE, privileged default, shared cluster without authorization.
4. What you ship: Docker hygiene checklist
Five hygiene controls + pass/fail on one lab Dockerfile + NEVER stranger tenant line.
5. What you record before the next lesson
Docker hygiene checklist path.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run docker against employer prod cluster API without authorization to 'check hygiene.'
Right
Docker hygiene checklist from `$CLOUD_LAB` local Dockerfile. Next: Image Scanning.
Mission: Docker hygiene checklist
1) Name five Docker hygiene controls. 2) Pass/fail stub per control on one lab Dockerfile. 3) Label `$CLOUD_LAB` source UTC. 4) Write NEVER stranger tenant Docker API line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Read-only rootfs — literacy exceptions?”
Knowledge Check
APPLY: Docker hygiene on Cyberlium uses:
Multiple choice
Knowledge Check
APPLY: True or False: Scanning employer prod ECR without RoE is lab.
True or False
Knowledge Check
APPLY: Hygiene includes:
Multiple choice