Runtime Named

Runtime security literacy — admission control, read-only rootfs, network policy stub, runtime threat detection, least-privilege service account — named rows on YOUR `$DEVSEC_LAB` deploy stubs.

Runtime Named• Audio Walkthrough

00:00/03:13

Visual · t36_runtime_named

Runtime = named deploy guard rows. $DEVSEC_LAB. Original Cyberlium.

Build-time scans miss runtime drift — name admission control and network policy rows on YOUR lab deploy stubs before tampering with stranger org clusters.

Runtime named literacy names: admission control policy category (OPA/Gatekeeper literacy stub), read-only root filesystem category, network policy stub category, runtime threat detection category (Falco literacy stub), and least-privilege service account category. Analyst documents runtime guard card on `$DEVSEC_LAB` lab deploy manifest — five rows with pass/fail literacy — without modifying stranger org Kubernetes clusters, without deploying crypto-miners as 'runtime test,' without bypassing admission control on prod without ticket. Cyberlium teaches runtime vocabulary on YOUR notes — defender deploy literacy. Refused: stranger cluster tampering, malicious runtime payloads, unauthorized prod deploy. Lab row: runtime guard card (five rows, manifest link, pass/fail stub).

1. Named runtime rows

Admission control, read-only rootfs, network policy, runtime detection, service account — five literacy anchors.

Each row cites YOUR lab manifest — not generic K8s hardening blog.

Command guide

Try these commands — Named runtime rows

═══ DOCKER & CONTAINER AUDIT ═══

Check container running state and port bindings

Command — copy this

docker ps --format "table {{.ID}}	{{.Image}}	{{.Status}}	{{.Ports}}" 2>/dev/null || echo "docker ps"

Inspect container for elevated capabilities and root user

Command — copy this

docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || true

Run security vulnerability scan on container image using Trivy

Command — copy this

trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"

═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace

Command — copy this

kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"

Primary tools to practice this lesson: curl, grep. Reference sites: NIST SSDF PS.2 (https://csrc.nist.gov/Projects/ssdf); CISA SBOM (https://www.cisa.gov/sbom); CISA Secure by Design (https://www.cisa.gov/securebydesign). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Build vs runtime split

Module 7 scans at build — runtime guards catch drift and live threats.

Link Module 7 CI gate — complementary not duplicate literacy.

3. Refused

No stranger cluster modifications; no malicious runtime payloads; no prod bypass without ticket.

Runtime literacy supports YOUR deploy hygiene — not cluster sabotage.

4. What you ship: runtime guard card

Five runtime rows + manifest link + pass/fail stub + NEVER stranger cluster tamper line.

5. What you record before the next lesson

Runtime guard card path.

6. Wrong vs right: stranger orgs vs YOUR repos

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Deploy test crypto-miner pod on stranger org leaked kubeconfig as 'runtime detection research.'
Right: Runtime guard card from `$DEVSEC_LAB` deploy stub. Next: SBOM Named.

Hands-on Exercise