Cloud & Container
Security Training
Read a credential out of a layer, escape a privileged container, poison a registry tag. Then rotate, rebuild, and cut the runtime down to what actually has to ship.
8 hands-on exercises across Docker images, container runtimes, and registries. Free to play, no sign-up required.
Container & Image Security
Secrets in Image Layers
Read a live token out of a layer the build tried to clean up.
- Pull a public image and walk its build history
- Rotate the credential before touching the Dockerfile
- Rebuild with a BuildKit secret mount
Privileged Containers
Turn a shell in a container into root on the host.
- Read what the privileged flag actually granted
- Take the host key through a writable mount
- Fix the image and the deployment separately
Exposed Docker Daemon
Take a production host through an unauthenticated Docker API.
- Find the node on a public status page
- Mount the host filesystem through the daemon
- Require mutual TLS and a scoped socket proxy
Vulnerable Base Images
Exploit a CVE in the OS layer nobody audits.
- Scan a deployed image and find a critical in the base
- Pin the base by digest and move to a slim variant
- Rescan to prove the finding is gone
Malicious Base Images
Trace a cryptominer back to one line in a Dockerfile.
- Compare a lookalike publisher against the official one
- Read the layer that fetched the payload
- Verify signatures at pull time, not after
Container Registry Exposure
Pull a private image, then replace the tag they deploy.
- Read production config out of an anonymous pull
- Push a backdoored layer to the release tag
- Require identity, scope push, freeze release tags
Container Network Exposure
A port mapping puts a production database on the internet.
- Connect to a published database port with no app involved
- Bind the mapping to loopback and redeploy
- Segment services onto a user-defined network
Minimal Container Images
Cut a 412MB runtime down to what actually has to ship.
- Pivot using the tooling the image shipped
- Split build from runtime with a multi-stage build
- Prove the shell is gone from the final image
The Developer Track
Application security split by attack surface. Free, hands-on, no sign-up.
-
Application Security
22 exercisesSQL Injection · Stored XSS · Server-Side Request Forgery
-
API Security
10 exercisesBroken Object Level Authorization · Mass Assignment · Excessive Data Exposure
-
Git & Repository Security
8 exercisesSecrets in Git History · Exposed .git Directory · Malicious Pull Requests
Frequently Asked Questions
What is container security training?
Container security training teaches engineers to treat the image and the runtime as a security boundary they have to configure deliberately, rather than as a packaging format that happens to isolate things.
These exercises cover what actually goes wrong in production: a credential recorded in a build layer, a container started with more host access than the workload needs, a daemon answering on the network, a base image nobody pinned, and a registry that answers without a login.
Is a container a security boundary?
Not by default. Container isolation is a set of kernel features, and a deployment can switch nearly all of them off without anything looking broken.
Root inside a container is root on the host kernel, so a privileged flag plus a host mount turns code execution in a low-value service into control of the machine underneath it. The boundary is something you configure, not something you get.
Why do secrets survive after a Dockerfile deletes them?
Image layers are append-only. A credential passed into one RUN is recorded in that layer, and a later RUN that removes the file only stacks a new layer on top.
Anyone who pulls the image gets every layer, so the value is still readable. Rotation is the step that cuts access; a multi-stage build or a BuildKit secret mount is what stops it happening again.
Are these exercises about Docker specifically, or cloud infrastructure generally?
This first course is Docker: images, layers, the daemon, registries, and container networking. It is the layer most teams touch first and the one where the failures are most concrete.
Kubernetes, cloud infrastructure, and infrastructure-as-code courses join the same category as they ship.
Who should take container security training?
Developers who write Dockerfiles, DevOps and platform engineers who own the build pipeline, SREs, and anyone who configures a registry or a container host.
Several of the fixes here are not application code. They are base-image pins, registry policies, daemon configuration, and deployment flags, which makes the exercises useful for the people who own those settings as much as for the people writing the service.
Are these container security exercises free?
Yes. Every exercise runs in your browser with no sign-up required.
Enterprise features such as completion analytics, SCORM and LTI packaging for your LMS, SSO, and custom content are available on paid plans.
See RansomLeak in Action
Try the free exercises or book a demo to see analytics, SCORM export, SSO, and custom content in your environment.