For Teachers · Back to the Module · Print with your browser's Print command.

A5 Teacher Answer Key: Container Runtime Hardening Depth

Teacher Answer Key (about 35 minutes, Applied level)

Name: ______________________ Class: __________ Date: __________

Read first: P9, P20

Learning Objectives

• [ ] Read /etc/docker/daemon.json and a container's hostconfig.json and name each setting that limits blast radius.
• [ ] Explain why the Docker socket and the docker group are root, and what rootless mode changes.
• [ ] Judge a running container by four questions: who is it, what can it call, how much can it use, and can it change itself.

Key Terms

Write each definition in your own words.

• Container: A group of processes isolated from the host and from each other by kernel namespaces, cgroups and capabilities.
• Namespace: A Linux kernel feature that gives processes their own view of resources such as process ids, network or mounts.
• Seccomp Profile: A list of system calls a process may make; a container runtime applies a default profile that blocks dangerous calls, and unconfined removes it.
• Rootless Mode: Running the container daemon and its containers inside a user namespace as an ordinary account, so a breakout does not land in root.
• Content Trust: Verifying a signature on an image before pulling or running it, so a substituted image is refused.
• Least Privilege: Giving every account and process only the access it needs, nothing more.

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only HOST-CTR- --out a5 and sort the findings into daemon defaults, socket and group, per-container settings and image trust.
2. Compare the vulnerable and hardened daemon.json and hostconfig.json in internal/lab/fixtures_containers_apps.go line by line; for each difference, name the check that would notice it.
3. On a test machine you are allowed to assess: getent group docker, then stat -c '%a %U:%G %n' /var/run/docker.sock, and decide whether the group's members should instead use sudo docker.

Self-Check Questions

1. A user is in the docker group but has no sudo rights. What can they do?

• [ ] a) Only list containers
• [x] b) Anything root can do, by starting a container with the host filesystem mounted
• [ ] c) Nothing until an administrator approves
• [ ] d) Only start containers without network access
• Answer: b. The Docker API is equivalent to root; group membership is unaudited root access.

1. Which setting removes Docker's default system call filter for one container?

• [ ] a) --memory 512m
• [x] b) --security-opt seccomp=unconfined
• [ ] c) --read-only
• [ ] d) --cap-drop ALL
• Answer: b. seccomp=unconfined disables the default profile that blocks dangerous system calls.

1. Why is a json-file log driver without max-size a problem?

• [ ] a) Logs are encrypted and cannot be read
• [x] b) One container can fill the host's disk with its own logs
• [ ] c) Docker refuses to start
• [ ] d) The logs are sent to the internet
• Answer: b. Unbounded logs are a denial of service against the host and every neighbour.

1. What does rootless mode change?

• [ ] a) Containers can no longer use the network
• [x] b) The daemon and containers run inside a user namespace as an ordinary account, so a breakout does not land in root
• [ ] c) Images are signed automatically
• [ ] d) Containers run without any namespaces
• Answer: b. Rootless mode limits the blast radius of a breakout; it does not sign images or remove networking.

1. What does userns-remap in daemon.json do?

• [x] a) Maps container root to an unprivileged host user
• [ ] b) Renames containers
• [ ] c) Turns off container networking
• [ ] d) Makes images smaller
• Answer: a. With remapping, root inside a container is an ordinary user on the host, so a breakout gains less.

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• NIST SP 800-190, Application Container Security Guide: https://csrc.nist.gov/pubs/sp/800/190/final
• Docker documentation, Docker Engine security: https://docs.docker.com/engine/security/
• Docker documentation, Rootless mode: https://docs.docker.com/engine/security/rootless/
• OWASP Docker Security Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html
• CIS Docker Benchmark (recommendation numbers are cited in each check): https://www.cisecurity.org/benchmark/docker

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.