Lab Path

DevSecOps literacy path on `$DEVSEC_LAB` — lab setup to mentor handoff with ethics gates at every station.

Lab Path• Audio Walkthrough

00:00/02:54

Visual · t36_lab_path

Lab path = visual DevSec chain on YOUR $DEVSEC_LAB. Original Cyberlium.

Draw the path from lab setup to mentor handoff — with stop signs at every stranger-org pipeline shortcut and sabotage recipe lane.

Document literacy path: `$DEVSEC_LAB` setup → DevSec fundamentals → pipeline security → SAST/secrets → DAST → IaC → containers → runtime/supply chain → findings/governance → capstone. Ethics gates: stranger org pipeline scans, sabotage recipes, unauthorized prod deploy, merge check bypass, malicious image/package guides — refused paths labeled red. UTC milestones and artifact IDs per station. Mermaid or sketch chmod 600. Honest N/A if brief skipped live repo — labeled. Defender breakpoint: where repo scope discipline prevented out-of-scope pipeline action.

1. Path stations

Setup, fundamentals, pipeline, SAST/secrets, DAST, IaC, containers, runtime/supply, findings, handoff — ten minimum stations.

Each station links evidence index row and module lesson ID.

Command guide

Try these commands — Path stations

═══ DOCKER & CONTAINER AUDIT ═══

Check container running state and port bindings

Command — copy this

docker ps --format "table {{.ID}}	{{.Image}}	{{.Status}}	{{.Ports}}" 2>/dev/null || echo "docker ps"

Inspect container for elevated capabilities and root user

Command — copy this

docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || true

Run security vulnerability scan on container image using Trivy

Command — copy this

trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"

═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace

Command — copy this

kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"

Primary tools to practice this lesson: curl, grep. Reference sites: Gitleaks (https://gitleaks.io/); Bridgecrew Checkov (https://www.checkov.io/); Aqua Trivy (https://aquasecurity.github.io/trivy/); OWASP ZAP (https://www.zaproxy.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.