For Teachers · Back to the Module · Print with your browser's Print command.

P9 Teacher Answer Key: Containers and Kubernetes

Teacher Answer Key (about 25 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: P1

Learning Objectives

• [ ] Explain why control of the Docker API equals root on the host.
• [ ] Recognise privileged containers, host namespaces, dangerous capabilities and sensitive mounts.
• [ ] Explain kubelet authentication and why etcd and kubeconfig files must be protected.

Key Terms

Write each definition in your own words.

• Container: A group of processes isolated from the host and from each other by kernel namespaces, cgroups and capabilities.
• Namespace: A Linux kernel feature that gives processes their own view of resources such as process ids, network or mounts.
• Capability: One of the separate privileges that together make up root's power, which can be granted or dropped individually.
• Least Privilege: Giving every account and process only the access it needs, nothing more.
• Privilege Escalation: Gaining higher privileges than intended, for example turning a normal user account into root.

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only HOST-CTR-,HOST-K8S-,HOST-DKR- --out p9
2. For the vulnerable container, list every isolation layer that was switched off and the docker run flag that switched it off.
3. On a test host with Docker: docker inspect --format '{{.HostConfig.Privileged}} {{.HostConfig.Binds}}' $(docker ps -q)

Self-Check Questions

1. Why is mounting /var/run/docker.sock into a container dangerous?

• [ ] a) It slows the container
• [x] b) The container can control Docker and therefore the host
• [ ] c) It disables logging
• [ ] d) It only lets the container read its own logs
• Answer: b. The Docker API is equivalent to root on the host.

1. What does --privileged do?

• [ ] a) Runs the container faster
• [x] b) Removes most isolation, giving the container nearly full host access
• [ ] c) Encrypts the container
• [ ] d) Runs the container as a non-root user
• Answer: b. Privileged containers have almost no isolation left.

1. Which kubelet setting is the hardened one?

• [ ] a) authorization mode AlwaysAllow
• [ ] b) anonymous authentication enabled
• [x] c) authorization mode Webhook with anonymous access disabled
• [ ] d) read-only port left on
• Answer: c. Webhook authorisation with anonymous access off protects the kubelet API. The read-only port should be off.

1. What is a container?

• [ ] a) A small virtual machine with its own kernel
• [x] b) A set of ordinary Linux processes isolated by namespaces, cgroups, capabilities and security profiles
• [ ] c) A compressed file of the host
• [ ] d) A separate physical server
• Answer: b. Containers share the host kernel. Their isolation comes from kernel features that can be switched off.

1. Why must etcd's data directory be readable only by root?

• [x] a) It holds every cluster object, including Secrets
• [ ] b) It holds container logs only
• [ ] c) It stores the kubelet program
• [ ] d) It is too large to share
• Answer: a. Anyone who reads etcd's data reads every Secret in the cluster.

1. Which practice does NIST SP 800-190 recommend?

• [ ] a) Run containers as root so they can repair themselves
• [x] b) Run as non-root, read-only where possible, from minimal scanned images
• [ ] c) Use --privileged for stability
• [ ] d) Share the host network namespace
• Answer: b. Least privilege, read-only filesystems and small scanned images reduce what a compromised container can do.

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• NIST SP 800-190, Application Container Security Guide: https://csrc.nist.gov/pubs/sp/800/190/final
• OWASP Docker Security Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html
• Kubernetes, Kubelet authentication and authorization: https://kubernetes.io/docs/reference/access-authn-authz/kubelet-authn-authz/

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.