For Teachers · Back to the Module · Print with your browser's Print command.

P9 Worksheet: Containers and Kubernetes

Student Worksheet (about 25 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: P1

Learning Objectives

• [ ] Explain why control of the Docker API equals root on the host.
• [ ] Recognise privileged containers, host namespaces, dangerous capabilities and sensitive mounts.
• [ ] Explain kubelet authentication and why etcd and kubeconfig files must be protected.

Key Terms

Write each definition in your own words.

• Container: ______________________________________________
• Namespace: ______________________________________________
• Capability: ______________________________________________
• Least Privilege: ______________________________________________
• Privilege Escalation: ______________________________________________

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only HOST-CTR-,HOST-K8S-,HOST-DKR- --out p9
2. For the vulnerable container, list every isolation layer that was switched off and the docker run flag that switched it off.
3. On a test host with Docker: docker inspect --format '{{.HostConfig.Privileged}} {{.HostConfig.Binds}}' $(docker ps -q)

Self-Check Questions

1. Why is mounting /var/run/docker.sock into a container dangerous?

• [ ] a) It slows the container
• [ ] b) The container can control Docker and therefore the host
• [ ] c) It disables logging
• [ ] d) It only lets the container read its own logs

1. What does --privileged do?

• [ ] a) Runs the container faster
• [ ] b) Removes most isolation, giving the container nearly full host access
• [ ] c) Encrypts the container
• [ ] d) Runs the container as a non-root user

1. Which kubelet setting is the hardened one?

• [ ] a) authorization mode AlwaysAllow
• [ ] b) anonymous authentication enabled
• [ ] c) authorization mode Webhook with anonymous access disabled
• [ ] d) read-only port left on

1. What is a container?

• [ ] a) A small virtual machine with its own kernel
• [ ] b) A set of ordinary Linux processes isolated by namespaces, cgroups, capabilities and security profiles
• [ ] c) A compressed file of the host
• [ ] d) A separate physical server

1. Why must etcd's data directory be readable only by root?

• [ ] a) It holds every cluster object, including Secrets
• [ ] b) It holds container logs only
• [ ] c) It stores the kubelet program
• [ ] d) It is too large to share

1. Which practice does NIST SP 800-190 recommend?

• [ ] a) Run containers as root so they can repair themselves
• [ ] b) Run as non-root, read-only where possible, from minimal scanned images
• [ ] c) Use --privileged for stability
• [ ] d) Share the host network namespace

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• NIST SP 800-190, Application Container Security Guide: https://csrc.nist.gov/pubs/sp/800/190/final
• OWASP Docker Security Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html
• Kubernetes, Kubelet authentication and authorization: https://kubernetes.io/docs/reference/access-authn-authz/kubelet-authn-authz/

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.