Cloud › Module 6 › Lesson 4
Lab — Docker
Docker lab on `$CLOUD_LAB` — hygiene checklist, scan summary, escape risk/defense matrix from local build.
Visual · t31_docker_lab
Lab: Docker pack on YOUR $CLOUD_LAB local Docker. Original Cyberlium.
Opening
Ship Docker literacy artifacts from YOUR local build — hygiene, scan triage, escape defenses — zero stranger tenant access or escape PoCs.
On YOUR `$CLOUD_LAB` per brief: (1) scope proof — local Docker host or instructor stub labeled YOUR account; (2) Dockerfile hygiene checklist five controls; (3) image scan summary three CVE rows; (4) escape risk/defense matrix four pairs; (5) UTC build log stub; (6) integrity — `$CLOUD_LAB` local Docker or kind YOUR cluster only, no stranger tenant API, no escape PoC, no unauthorized prod registry; (7) chmod 600 pack. Cross-link Modules 1–5 cloud literacy — container hygiene extends shared responsibility and IAM rows.
1. Lab deliverables
Hygiene + scan + escape matrix cross-indexed to one lab image build.
Build log cites digest pin — not floating latest tag.
Command guide
Try these commands — Lab deliverables
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Optional command
Docker inspect — https://docs.docker.com/engine/reference/commandline/inspect/ Docker best practices — https://docs.docker.com/develop/develop-images/dockerfile_best-practices/
Trivy — https://aquasecurity.github.io/trivy/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install docker.io # or Docker Engine docs
macOS:
Command — copy this
brew install --cask docker
Windows: Install Docker Desktop
═══ LINUX / macOS ═══
Command — copy this
export CLOUD_LAB=${CLOUD_LAB:-$HOME/cyberlium-lab/t31-cloud}YOUR images — inspect security-relevant settings
Command — copy this
CID=$(docker ps -q | head -1)
if [ -n "$CID" ]; then
docker inspect --format '{{.HostConfig.Privileged}} privileged {{.Config.User}} user' "$CID"
docker inspect --format '{{json .HostConfig.CapDrop}} cap_drop' "$CID"
else
echo 'No running containers — start YOUR lab container or review checklist'
fi
cat > "$CLOUD_LAB/containers/docker-lab-findings.md" <<'EOF'
# Docker Lab Findings — YOUR containers
- Privileged mode: should be false
- User: should not be root (0)
- CapDrop: should drop unnecessary capabilities
- Image scan: trivy HIGH/CRITICAL count documented
## Refusals
- No escape PoCs; no scanning stranger registries without authorization
EOFCommand — copy this
grep -E 'Privileged|Refusals|YOUR containers' "$CLOUD_LAB/containers/docker-lab-findings.md"
═══ WINDOWS ═══
Command — copy this
docker ps 2>$null; if (-not $?) { Write-Output 'Start Docker Desktop for YOUR image lab' }
Get-Content $HOME/cyberlium-lab/t31-cloud/containers/docker-hygiene-checklist.md | Select-String rootPrimary tools to practice this lesson: docker, grep. Reference sites: Docker inspect (https://docs.docker.com/engine/reference/commandline/inspect/); Docker best practices (https://docs.docker.com/develop/develop-images/dockerfile_best-practices/); Trivy (https://aquasecurity.github.io/trivy/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Quality bar
Each row cites lab Dockerfile field — not generic cloud advice.
Zero escape PoC steps or privileged abuse in any artifact.
3. Teardown
Stop lab containers; secure notes chmod 600; no images pushed to prod without RoE.
Archive stub optional per brief.
4. What you ship: Docker lab pack
Hygiene + scan + escape matrix + build log + integrity — chmod 600.
5. What you record before the next lesson
Docker lab pack path.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Docker lab includes container escape PoC script as deliverable.
Right
Docker lab pack on `$CLOUD_LAB` local build. Next: quiz.
Mission: Docker lab
1) Scope and local Docker proof. 2) Hygiene checklist and scan summary. 3) Escape risk/defense matrix. 4) Integrity block; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum scan rows if brief sparse?”
Knowledge Check
APPLY: Docker lab scope:
Multiple choice
Knowledge Check
APPLY: True or False: Escape PoC belongs in Docker lab.
True or False
Knowledge Check
APPLY: Docker lab pack should:
Multiple choice