Lion Cipher Lab
Run Docker containers more securely on your own machine
- Cloud Security
- Beginner
- ~40 min
- Free · no account required
Why it matters
Getting a container to run is easy; getting it to run without quietly widening your attack surface is the part almost nobody teaches beginners. A container is not a hard wall around your machine — by default it shares the host kernel, and a process running as root inside a container is often root-adjacent to the host if something goes wrong. The handful of habits in this lab are exactly what a working engineer expects before a container ships: don't run as root inside it, don't hand it the whole host with --privileged, drop the Linux capabilities it doesn't need, start from a small trusted…
What you'll learn
- container hardening
- least privilege for containers
- Linux capabilities
- minimal base images
- image vulnerability scanning
- reading CVE results
- Trivy
- Docker Scout
Steps in this lab
- The one thing to understand: a container is isolation, not a wall
- Don't run as root inside the container
- Never reach for --privileged casually
- Start from an official, minimal base image
- Scan a real image for known vulnerabilities with Trivy
- Cross-check with Docker Scout, built into Docker
- Keep images updated — a scan is a snapshot, not a subscription
- What you just did — and why it's the container security baseline