Harden a container four ways and confirm each restriction bites

short · 50 min · Objective 4.3

Task

Apply the four runtime hardening measures one at a time, and after each one attempt the thing it is supposed to prevent. A restriction you have not tested is a setting, not a control.

Steps

Run a container with defaults. Inside it, record the user id, attempt to write to the root filesystem, list the capabilities held, and attempt to reach the host's metadata address. Save all four results to lab/hardening.md as the baseline.
Re-run forcing a non-root user. Repeat the four attempts and record which now fail.
Re-run additionally with a read-only root filesystem and a writable temporary mount. Repeat and record.
Re-run additionally dropping all capabilities and preventing privilege escalation. Repeat and record.
Re-run additionally with no network access to the host address. Repeat and record, then write the summary table of which setting blocked which attempt.

Verify

grep -Eci 'non-root|uid' lab/hardening.md
grep -Eci 'read-only|readonly' lab/hardening.md
grep -Eci 'capabilit' lab/hardening.md
grep -Eci 'metadata' lab/hardening.md
grep -Ec 'denied|refused|permission|failed' lab/hardening.md

All five non-zero, with at least four recorded denials. If nothing was denied at any stage, the attempts were not actually exercising the restrictions.

This is an independent study companion for CompTIA Cloud+ CV0-004 and is not produced by or endorsed by CompTIA.