Question: 6 SIMULATION. Analyze and edit the given Dockerfile FROM ubuntu:latest RUN apt-get update -y RUN apt-get install nginx -y COPY entrypoint.sh / ENTRYPOINT ["/entrypoint.sh"] USER ROOT…

This simulation tests knowledge of container security hardening - identifying and fixing insecure defaults in a Dockerfile and applying a proper Kubernetes Pod securityContext to enforce least-privilege principles.

Submitted by rachelw· May 4, 2026Minimize Microservice Vulnerabilities

Question

Question: 6 SIMULATION. Analyze and edit the given Dockerfile
FROM ubuntu:latest
RUN apt-get update -y
RUN apt-get install nginx -y
COPY entrypoint.sh /
ENTRYPOINT ["/entrypoint.sh"]
USER ROOT
Fixing two instructions present in the file being prominent security best practice issues
Analyze and edit the deployment manifest file
apiVersion: v1
kind: Pod
metadata:
name: security-context-demo-2
spec:
securityContext:

Explanation

Approach. In the Dockerfile, the two security issues are: (1) FROM ubuntu:latest - the latest tag is non-deterministic and can silently pull a vulnerable image; fix it by pinning to a specific digest or version tag (e.g., ubuntu:22.04). (2) USER ROOT - running a container as root grants unnecessary elevated privileges that an attacker can exploit; replace it with a non-root user such as USER nginx or a dedicated low-privilege UID (e.g., USER 1000). For the Kubernetes Pod manifest, the empty securityContext block must be populated to enforce least-privilege: add runAsNonRoot: true, runAsUser: 1000, runAsGroup: 3000, allowPrivilegeEscalation: false, and optionally readOnlyRootFilesystem: true to prevent runtime writes to the container filesystem. These controls map directly to CIS Kubernetes and Docker Benchmarks.

Concept tested. Container and orchestration security hardening: pinning base image versions to prevent supply-chain drift, enforcing non-root execution in both Dockerfiles (USER directive) and Kubernetes (Pod/container securityContext), and applying the principle of least privilege across the full container lifecycle.

Reference. CIS Docker Benchmark v1.6 (sections 4.1 – non-root user, 4.2 – trusted base images); CIS Kubernetes Benchmark v1.8 (section 5.7 – Pod Security Contexts); Kubernetes docs: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

Topics

#Dockerfile Security#Kubernetes SecurityContext#Least Privilege#Container Image Security

Community Discussion

No community discussion yet for this question.

Full CKS Practice