Exam
CKS
CKS · System Hardening
Harden the Docker Daemon on a Node
Perform the following tasks to secure the cluster node: Remove user developer from the docker group. Do not remove the user from any other group.
Live lab access
This task description is public. Live practice requires full access unless this is the selected free weekly task. See this week's free task.
Create an account to continue →
On a phone? Read the task and create your account here, then sign in on a desktop or laptop for the terminal lab. Nothing starts until you choose Start.
The task
Task
Perform the following tasks to secure the cluster node:
- Remove user
developerfrom thedockergroup. Do not remove the user from any other group. - Reconfigure and restart the Docker daemon to ensure that the Unix socket belongs to the group
root. - Reconfigure and restart the Docker daemon to ensure it does not listen on any TCP port.
After completing your work, ensure the Kubernetes cluster is healthy.
*Lab note: this lab node holds the Docker configuration but does not run a live systemd/dockerd, so systemctl commands will not work here (System has not been booted with systemd...). Edit the configuration directly; the grader inspects the on-disk config.*
What this tests
Reduce the host attack surface with AppArmor, seccomp, and kernel hardening. On the CKS exam, System Hardening tasks are graded purely on what you build in the cluster - not multiple choice - so the only way to get faster is to do them on a real cluster against a clock.
Practice it for real
The public description lets you study the task before signing up. Full access includes this live lab; the selected Task of the Week is free with an account. You solve the task in a real terminal, hit validate, and a programmatic checker scores exactly what you got right and wrong (with partial credit). You can open the solution while practising, then retry and use the failed checks to improve your score.