This exam closes the "Harden execution" module of the Docker course. The mission: an exposed service runs with every right that Docker grants by default, its secret can be read in its environment, its root is writable, and since a firewall update it can no longer reach its provider. You must harden it without breaking it: remove what it does not need, without it ceasing to answer or to do its job. It teaches you nothing new, it checks what you learned. Allow about 60 minutes on a virtual machine running Docker Engine 29.9.2.
What you will learn
- Say what the exam expects and on which state of the system it grades you.
- Spot the two requirements that no total can offset.
- Work out, depending on the hints requested, the checks you must pass to reach the threshold.
- Spot the lessons to review before you start.
Prerequisites
The lessons of the "Harden execution" module must be finished, up to Find orphan Docker volumes without deleting everything. The exam assumes that you know how to drop a container's rights, declare a read-only root, pass a secret by a means other than the environment, fix a firewall without disabling it, and find a named volume again when you recreate a container.
Use the lab environment you used for the previous lessons. The image of the service is provided: there is nothing to rebuild.
What does the exam ask of you?
The statement describes an exposed service that runs with the default settings. At the end, the state of the machine must show five things:
- the service has lost its unneeded capabilities, it forbids any privilege escalation, and it still answers;
- its root is read-only, its writes go through a declared path, and a write anywhere else is refused;
- its secret appears neither in the container's environment nor in the image, and the service still receives it;
- the flow to its provider succeeds, the firewall stays active and its protection rule stays in place;
- the volume that holds the useful data is mounted back and its data is served, and the two throwaway volumes are removed.
No capability is named. The full statement, with the names of the service, the provider and the volumes, is read in the lab, and only there. It also says what the exam does not measure: seccomp and AppArmor are not assessed.
How is it graded?
The lab does not read the commands you typed. It reads back the state of the system at the moment you hand in your work. Five checks of equal weight share the grade.
| Check | What is read |
|---|---|
| Rights dropped, service alive | The capability set is reduced, privilege escalation is forbidden and the service answers |
| Read-only root | A write outside the declared paths is refused, and the service runs with its writable paths |
| Secret out of the environment | The secret is neither in the environment nor in the image, and the value served is still the right one |
| Flow restored, firewall intact | The flow succeeds, the firewall table exists, and its protection still acts |
| Useful volume served | The data of the useful volume is served, and the throwaway volumes are removed |
The first check imposes no capability by name: another way of doing without them is accepted, as long as the set is reduced and the service runs.
The second reads a fact, not a flag: it attempts a write and looks at whether it is refused.
The third compares the value served with the one it expects. A clean service that no longer receives its secret fails.
The fifth reads the data served, not the mere existence of the volume: a volume mounted back empty is worth nothing.
The threshold is 75 points, and this exam carries two requirements that nothing offsets: the secret must not be readable in the environment, and the flow must succeed without the firewall being disabled, its table deleted or its protection rule removed. Failing either of these two checks fails the exam even with the four others passed. These are two open doors, and an open door is not offset by work done elsewhere. The 75-point threshold may be recalibrated after the first attempts.
Which rules apply?
This exam measures, it does not guide you. Three rules follow from that.
- The lab offers four hints, from the vaguest to the most explicit, which cost 10, 15, 20 and 25 points, and whose costs add up. The score is the share of checks passed, multiplied by a scale of 100 points minus the cost of the hints requested.
- You may consult the lessons of the course and the official Docker documentation, as you would at work.
- The statement explains nothing again: the lessons of the module have already taught what you need to know.
With five checks, each is worth a fifth of the scale. The table shows the margin left by each level of hints.
| Hints requested | Scale | Checks to pass |
|---|---|---|
| None | 100 | 4 out of 5 (80 points) or 5 out of 5; 3 out of 5 give 60 |
| The first | 90 | 5 out of 5 (90 points; 4 out of 5 give 72) |
| The first two | 75 | 5 out of 5 (75 points, right at the threshold) |
| Three or more | 55 at most | Threshold not reachable |
In every case, the two critical checks, the secret and the flow, must be among the checks passed. With no hint, four out of five are enough only if those four include these two.
Which lessons should you review before starting?
The statement does not say which actions it asks for, and this list does not try to point them out either. It gathers the lessons of the course that teach an action useful here. Start by rereading those where your last labs were difficult.
- Securing Docker in production
- Read-only root filesystem, and a shutdown without data loss
- Docker secrets: manage sensitive data safely (in French)
- Inject secrets, and know their limits
- Diagnose Docker network and firewall issues
- Find orphan Docker volumes without deleting everything
Take the exam
The lab prepares the machine, gives you the statement, then grades the state in which you leave it. Start it when you have about 60 minutes ahead of you, so that you can work in one go.
From your lab environment, the command is launched like this:
dsoxlab run epreuve-durcir-sans-casserThe statement is displayed, you work on the machine, then the lab plays its five checks. Read the result check by check: a message describes what is missing from the final state, never the command to type.
After the exam
If you clear the threshold with the two critical checks passed, you know how to harden a service without breaking it, on the points measured. You can move on to the rest of the course. A result under the threshold does not mean that you failed to learn: it shows where the gap is.
Link each failed check to a lesson in the list above, reread it, then redo the action yourself. Do not try to memorize an answer.
Key points
- The exam is a measurement: nothing is explained again, hints cost points, and the grade covers the final state of the machine, not your commands.
- You need 75 points, and two checks are offset by no total: the secret out of the environment, and the flow restored with the firewall active.
- Hardening is not removing: a service that no longer answers, or no longer receives its secret, does not pass.
- A flag states an intention, a test shows the result: the lab attempts the write, reads the value served and the data of the volume.
- Disabling the firewall makes the symptom disappear and leaves the machine bare: it is one of the two open doors the exam refuses.