Skip to content
CKSMonitoring, Logging and Runtime SecuritySingle nodeMedium

Immutable containers at runtime

Scenario cks-run-002 · about 8 minutes · 7 points · 5 grader checks

Run nginx with a read-only root filesystem, keeping only the directories it really needs writable through emptyDir volumes.

  • immutability
  • readonlyrootfilesystem
  • emptydir
  • runtime-security
  • deployment

What you will practise

  • Make a container's root filesystem read-only
  • Find the paths an application must write to and back them with emptyDir
  • Keep the workload serving after the hardening

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start cks-run-002

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

An attacker who gets a shell in a container should not be able to change its files. Make the containers of the Deployment "frontend" in namespace "immutable" (container "nginx", image nginx:1.27, 2 replicas) immutable at runtime: - the root filesystem is read-only; - privilege escalation is not allowed; - nginx still needs to write to /var/cache/nginx and /var/run: give it an emptyDir volume for each of these two paths, nothing else writable. Edit the Deployment (do not recreate it). Both replicas must be Ready and still serve HTTP on port 80.

Requirements and details

Certification
CKS · Certified Kubernetes Security Specialist
Domain
Monitoring, Logging and Runtime Security
Difficulty
Medium
Cluster topology
Single node
Cluster features
None beyond the base cluster
Recommended time
8 minutes
Points
7
Grader checks
5
Kubernetes version
1.35
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 5 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Monitoring, Logging and Runtime Security labs

CKSMonitoring, Logging and Runtime SecurityHard

Audit logging with a tailored policy

Write an audit policy with per-resource levels and wire it into the API server static pod with log rotation.

Single node · ~10 min · 9 points

  • audit-logging
  • kube-apiserver
  • audit-policy
  • static-pod
  • monitoring

goldenkube start cks-run-001

CKSMonitoring, Logging and Runtime SecurityMedium

Find and contain a crypto-miner process

Investigate running containers to find the one executing a mining process, record it and contain it without destroying evidence.

Single node · ~7 min · 8 points

  • runtime-security
  • incident-response
  • processes
  • behavioral-analytics
  • crictl

goldenkube start cks-run-003

CKSMonitoring, Logging and Runtime SecurityMedium

Investigate an audit log and revoke access

Use an exported audit log to identify who deleted a Secret and from where, then revoke that user's namespace access.

Single node · ~8 min · 8 points

  • audit-logs
  • incident-response
  • jq
  • rbac
  • investigation

goldenkube start cks-run-004

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.