Container security basics in Cybersecurity - Mini Project: Build & Apply

Container security basics

📖 Scenario: You are working in a company that uses containers to run applications. Containers help package software and its environment so it works the same everywhere. But containers can have security risks if not set up carefully.To keep containers safe, you need to understand some basic security steps.

🎯 Goal: Build a simple checklist of container security best practices. This checklist will help you remember important steps to keep containers secure in real projects.

📋 What You'll Learn

Create a list of common container security risks

Add a variable to set a security level threshold

Use list slicing to select the first risks up to the threshold

Add a final note about monitoring containers regularly

💡 Why This Matters

🌍 Real World

Containers are widely used to deploy applications quickly and consistently. Knowing how to identify and manage container security risks helps keep software safe from attacks.

💼 Career

Many IT and cybersecurity jobs require understanding container security basics to protect company systems and data.

1

Create a list of container security risks

Create a list called container_risks with these exact strings: 'Unpatched images', 'Exposed ports', 'Weak credentials', 'Insecure network policies', and 'Excessive privileges'.

Cybersecurity

# Create the list container_risks with the specified risks
# Your code here

Hint

Use square brackets [] to create a list and separate items with commas.

2

Set a security risk threshold

Create a variable called risk_threshold and set it to 3. This will help filter the most important risks later.

Cybersecurity

container_risks = ['Unpatched images', 'Exposed ports', 'Weak credentials', 'Insecure network policies', 'Excessive privileges']
# Create risk_threshold variable and set it to 3
# Your code here

Hint

Just assign the number 3 to the variable risk_threshold.

3

Filter important risks using the threshold

Create a list called important_risks that contains the first risk_threshold items from container_risks. Use list slicing with container_risks[:risk_threshold].

Cybersecurity

container_risks = ['Unpatched images', 'Exposed ports', 'Weak credentials', 'Insecure network policies', 'Excessive privileges']
risk_threshold = 3
# Create important_risks list with first risk_threshold items from container_risks
# Your code here

Hint

Use list slicing to get the first few items from the list.

4

Add a final note about monitoring

Create a variable called final_note and set it to the string 'Regularly monitor containers for unusual activity.' to remind about ongoing security.

Cybersecurity

container_risks = ['Unpatched images', 'Exposed ports', 'Weak credentials', 'Insecure network policies', 'Excessive privileges']
risk_threshold = 3
important_risks = container_risks[:risk_threshold]
# Create final_note variable with the specified reminder string
# Your code here

Hint

Assign the exact string to the variable final_note.

Practice

1. What is the main reason containers need special security measures?

easy

A. Containers automatically encrypt all data without configuration

B. Containers are always offline and isolated from networks

C. Containers do not run any applications

D. Containers share the host OS, so vulnerabilities can affect the whole system

Solution

1. Step 1: Understand container architecture

   Containers share the host operating system kernel, unlike virtual machines which have separate OS instances.

2. Step 2: Identify security risk from shared OS

   Because containers share the OS, a vulnerability in one container can potentially affect others or the host.

3. Final Answer:

   Containers share the host OS, so vulnerabilities can affect the whole system -> Option D

4. Quick Check:

   Shared OS = Need special security [OK]

Hint: Remember: shared OS means shared risk [OK]

Common Mistakes:

• Thinking containers are fully isolated like virtual machines
• Assuming containers do not run apps
• Believing containers encrypt data by default

2. Which of the following is the correct command to scan a Docker container image for vulnerabilities?

easy

A. docker push <image_name>

B. docker scan <image_name>

C. docker run <image_name>

D. docker build <image_name>

Solution

1. Step 1: Identify scanning command

   The docker scan command is used to check container images for known security issues.

2. Step 2: Differentiate from other commands

   docker build creates images, docker run starts containers, and docker push uploads images to a registry.

3. Final Answer:

   docker scan <image_name> -> Option B

4. Quick Check:

   Scan command = docker scan [OK]

Hint: Scan images with 'docker scan' command [OK]

Common Mistakes:

• Confusing build or run commands with scanning
• Using push command to scan images
• Not specifying image name with scan

3. Consider this Dockerfile snippet:

FROM alpine:latest
RUN apk add --no-cache curl
CMD ["curl", "http://example.com"]

What is the main security risk in this container setup?

medium

A. The CMD command is incorrect syntax

B. Alpine Linux is not supported for containers

C. Using the latest tag can introduce untested vulnerabilities

D. The container does not expose any ports

Solution

1. Step 1: Analyze the use of 'latest' tag

   Using 'latest' means the image can change over time, possibly introducing new vulnerabilities without notice.

2. Step 2: Check other options for correctness

   CMD syntax is correct, Alpine is a common lightweight base image, and not exposing ports is not a risk itself.

3. Final Answer:

   Using the latest tag can introduce untested vulnerabilities -> Option C

4. Quick Check:

   Latest tag = potential risk [OK]

Hint: Avoid 'latest' tag for stable security [OK]

Common Mistakes:

• Thinking CMD syntax is wrong
• Believing Alpine is insecure by default
• Assuming no exposed ports means no risk

4. You have a container running with root privileges. Which change improves security the most?

medium

A. Run the container as a non-root user

B. Increase the container's CPU limits

C. Add more environment variables

D. Use the host network mode

Solution

1. Step 1: Understand privilege risks

   Running containers as root can allow attackers to gain full control if compromised.

2. Step 2: Identify best security practice

   Running as a non-root user limits permissions and reduces damage from attacks.

3. Final Answer:

   Run the container as a non-root user -> Option A

4. Quick Check:

   Non-root user = better security [OK]

Hint: Never run containers as root user [OK]

Common Mistakes:

• Thinking CPU limits improve security
• Adding environment variables does not secure
• Using host network mode increases risk

5. You want to securely store API keys inside a container without exposing them in the image or logs. Which approach is best?

hard

A. Use Docker secrets or environment variables managed outside the image

B. Hardcode the keys in the Dockerfile

C. Print keys in container logs for easy access

D. Store keys in a public GitHub repository

Solution

1. Step 1: Identify secure secret management

   Docker secrets or environment variables injected at runtime keep keys out of images and logs.

2. Step 2: Evaluate insecure options

   Hardcoding keys, logging them, or storing publicly exposes secrets to attackers.

3. Final Answer:

   Use Docker secrets or environment variables managed outside the image -> Option A

4. Quick Check:

   External secret management = secure keys [OK]

Hint: Keep secrets outside images and logs [OK]

Common Mistakes:

• Hardcoding secrets in Dockerfile
• Logging secrets accidentally
• Publishing secrets publicly