Home › CKS practice tasks › Secure the Docker Daemon
CKS · System Hardening

Secure the Docker Daemon

A node has insecure Docker permissions.

Solve this on a real cluster — free → All CKS tasks
🗓️ Free Task of the Week: one CKS task is unlocked free for everyone every week — no card, real cluster, auto-graded (2 tries/week). Create a free account and check whether this one is live now.

The task

Task

A node has insecure Docker permissions.

Requirements

  1. Remove the user testuser from the docker group
  2. Ensure that the Docker socket /var/run/docker.sock is owned by root:root

Verify that testuser is no longer part of the docker group and that the Docker socket ownership is correct.

Exam
CKS
Domain
System Hardening
Grading
Programmatic · partial credit
Reference
Kubernetes docs ↗

What this tests

Reduce the host attack surface with AppArmor, seccomp, and kernel hardening. On the CKS exam, System Hardening tasks are graded purely on what you build in the cluster — not multiple choice — so the only way to get faster is to do them on a real cluster against a clock.

Practice it for real

prepium.sh drops you into your own isolated Kubernetes cluster in the browser — no install, no credit card. You solve the task in a real terminal, hit validate, and a programmatic checker scores exactly what you got right and wrong (with partial credit). The canonical solution unlocks after you attempt it, so you learn the fast, exam-ready way to do it.

Start free → CKS overview