Secure an Unsafe Container

Learning objectives

• Enumerate the insecure settings
• Remove privileged mode and drop capabilities
• Run as non-root with a read-only filesystem
• Remove the socket mount and embedded secret
• Keep the app working

Before you start

Required software: Docker Engine 24+

Prerequisites: Docker Security path (or Image Engineering)

1. Download and unzip the lab.
2. Start it: docker compose up -d.
3. Review the compose file and Dockerfile — every planted issue is visible in configuration.

Instructions

Hints

💡 The Docker socket is mounted

Mounting /var/run/docker.sock gives the container root-equivalent control of the host. Unless the app truly needs it, remove the mount entirely.

💡 How do I drop capabilities?

Start from cap_drop: [ALL] and add back only what the app needs with cap_add. Combine with security_opt: [no-new-privileges:true].

Validate your work

From the lab folder, run:

bash validation/validate.sh

The script reads only your local Docker state, never transmits data off your machine, and returns a status code:

• 0 — Lab successfully completed
• 1 — Validation failed
• 2 — Required dependency missing
• 3 — Lab environment not running
• 4 — Configuration error
• 5 — Validation timed out

Note: validation targets Linux first. On Docker Desktop (macOS/Windows) some host-level checks (e.g. disk usage) may report differently; each script documents its limitations.

Solution

Reset the lab

• docker compose down -v && docker compose up -d from the original lab files restores the starting (broken) state.

Interview questions

• Why is mounting the Docker socket into a container dangerous?
• What does `no-new-privileges` do?
• How do you make a container filesystem read-only while keeping writable temp space?