Harden the Container

Strip privileges from a dangerously misconfigured production container.

A advanced Docker challenge worth 20 points. Solve it hands-on in a real Docker environment in your browser - no local setup, no fake shells.

The Challenge

Scenario: Security audit, CRITICAL finding: payments runs --privileged with the Docker socket mounted. Code execution in that container = full host takeover.

Tasks: recreate payments (image nginx:alpine, port 8090 → 80) hardened:

• not privileged, no docker.sock mount
• --cap-drop ALL, adding back only CHOWN SETGID SETUID NET_BIND_SERVICE
• --security-opt no-new-privileges:true
• --read-only root filesystem, with tmpfs at /var/cache/nginx and /var/run
• Site still answers on 8090 (browser panel)

Commands to learn: --cap-drop/--cap-add, --security-opt, --read-only, --tmpfs

Run check when done.