DevSecOps › Module 7 › Lesson 4
Lab — Containers
Container pipeline lab on `$DEVSEC_LAB` — image scan card, Trivy scan card, base image hygiene bundled.
Visual · t36_container_lab
Lab: container pack on YOUR $DEVSEC_LAB. Original Cyberlium.
Opening
Ship container security artifacts from YOUR lab image — scan, Trivy, hygiene — zero stranger registry scans or malicious image recipes.
On YOUR `$DEVSEC_LAB` per brief: (1) scope proof — lab Dockerfile and image tag labeled; (2) image scan card Module 7-1; (3) Trivy scan card Module 7-2; (4) base image hygiene checklist Module 7-3; (5) CI scan gate stub (fail on critical literacy); (6) integrity — `$DEVSEC_LAB` only, no stranger org registry scans, no malicious payloads, no prod image pulls without ticket; (7) chmod 600 pack. Cross-link Modules 3 and 6 pipeline/IaC work — container shift-left literacy handoff.
1. Lab deliverables
Scan + Trivy + hygiene cross-indexed to one lab image.
CI gate stub cites honest severity threshold — not fabricated clean scan.
Command guide
Try these commands — Lab deliverables
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OWASP ZAP — https://www.zaproxy.org/ NIST SSDF RV.1 — https://csrc.nist.gov/Projects/ssdf CISA Secure by Design — https://www.cisa.gov/securebydesign
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
cat > "$DEVSEC_LAB/notes/dast-lab-summary.md" <<'EOF'
# DAST Lab Summary — YOUR lab
- zap-named.txt: OWASP ZAP baseline literacy
- baseline-plan.md: 127.0.0.1:8080 scope + optional docker run
- zap-optional-run.sh: localhost-only wrapper
## Integrity
- Baseline against YOUR localhost only
- curl ZAP docs for literacy — no stranger site scans
EOFCommand — copy this
grep -E 'localhost|Integrity|127.0.0.1' "$DEVSEC_LAB/notes/dast-lab-summary.md" grep HARD "$DEVSEC_LAB/notes/zap-named.txt" "$DEVSEC_DAST/baseline-plan.md" ls "$DEVSEC_DAST/"
═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t36-devsec/dast/baseline-plan.md | Select-String 127.0.0.1 Get-Content $HOME/cyberlium-lab/t36-devsec/notes/zap-named.txt | Select-String HARD
Primary tools to practice this lesson: grep, curl. Reference sites: OWASP ZAP (https://www.zaproxy.org/); NIST SSDF RV.1 (https://csrc.nist.gov/Projects/ssdf); CISA Secure by Design (https://www.cisa.gov/securebydesign). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Quality bar
Each row cites lab image source — not generic container blog advice.
Zero stranger registry or prod references in pack.
3. Teardown
Secure notes chmod 600; lab image tagged per brief.
Archive stub optional per brief.
4. What you ship: container lab pack
Scan + Trivy + hygiene + CI gate stub + integrity — chmod 600.
5. What you record before the next lesson
Container lab pack path.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Container lab includes malicious image payload recipe as bonus deliverable.
Right
Container lab pack on `$DEVSEC_LAB` lab image. Next: quiz.
Mission: container lab
1) Scope and lab image proof. 2) Image scan and Trivy cards. 3) Base image hygiene checklist. 4) Integrity block; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “CI gate threshold — minimum literacy stub?”
Knowledge Check
APPLY: Container lab scope:
Multiple choice
Knowledge Check
APPLY: True or False: Malicious image recipes earn container lab credit.
True or False
Knowledge Check
APPLY: Container lab pack should:
Multiple choice