Container Security for Developers

Overview of the course, learning objectives and syllabus

What containers actually are at the kernel level -- namespaces, cgroups, and the shared host kernel -- and why that shared foundation means a misconfigured container affects every workload on the host.

How vulnerability scanners read image layers to find known-bad packages, why the XZ Utils backdoor entered through a dependency and not application code, and how multi-stage builds and digest pinning shrink the attack surface.

In this lab, you’ll get hands-on experience fixing two common security issues in a simple CI/CD pipeline for a containerised Node.js app. We will look at: (a) unpinned GitHub Actions in your CI workflow and (b) a container that runs as root

Why deleting a secret in a later Dockerfile layer leaves it permanently readable in the layer history, how AI-generated Dockerfiles reproduce this pattern reliably, and how to keep secrets out of the build context entirely.

The three interlocking privilege mechanisms in containers -- root processes, Linux capabilities, and SUID binaries -- how the Leaky Vessels vulnerabilities made each one matter, and how to drop to the minimum privilege a container needs.

Learn how to exploit a privileged container and then securing it

Learn how to exploit a container that runs as root and then securing it

Why both common DinD patterns used in CI/CD pipelines -- daemon in a container and socket mount -- provide a direct path to host compromise, and which rootless build tools eliminate the need for either

How seccomp profiles block dangerous syscalls before they reach the kernel, how AppArmor restricts filesystem and network access at the resource level, and why Dirty COW is the clearest example of what namespace isolation alone cannot stop.

Learn how to identify unnecessary capabilities of a container, how to exploit them and how to secure them.

Learn how to exploit setuid binaries in a container and how to secure them.