Harden the Docker Daemon on a Node

Perform the following tasks to secure the cluster node: Remove user developer from the docker group. Do not remove the user from any other group.

Solve this on a real cluster - free → All CKS tasks

🗓️ Free Task of the Week: one CKS task is unlocked free for everyone every week - no card, real cluster, auto-graded (2 tries/week). Create a free account and check whether this one is live now.

The task

Task

Perform the following tasks to secure the cluster node:

Remove user developer from the docker group. Do not remove the user from any other group.
Reconfigure and restart the Docker daemon to ensure that the Unix socket belongs to the group root.
Reconfigure and restart the Docker daemon to ensure it does not listen on any TCP port.

After completing your work, ensure the Kubernetes cluster is healthy.

*Lab note: this lab node holds the Docker configuration but does not run a live systemd/dockerd, so systemctl commands will not work here (System has not been booted with systemd...). Edit the configuration directly; the grader inspects the on-disk config.*

Exam

CKS

Domain

System Hardening

Grading

Programmatic · partial credit

Reference

Kubernetes docs ↗

What this tests

Reduce the host attack surface with AppArmor, seccomp, and kernel hardening. On the CKS exam, System Hardening tasks are graded purely on what you build in the cluster - not multiple choice - so the only way to get faster is to do them on a real cluster against a clock.

Practice it for real

prepium.sh drops you into your own isolated Kubernetes cluster in the browser - no install, no credit card. You solve the task in a real terminal, hit validate, and a programmatic checker scores exactly what you got right and wrong (with partial credit). The canonical solution unlocks after you attempt it, so you learn the fast, exam-ready way to do it.

Start free → CKS overview