MENU
Analyze and edit the given Dockerfile
FROM ubuntu:latest
RUN apt-get update -y
RUN apt-install nginx -y
COPY entrypoint.sh /
ENTRYPOINT ["/entrypoint.sh"]
USER ROOT
Fixing two instructions present in the file being prominent security best practice issues
Analyze and edit the deployment manifest file
apiVersion: v1
kind: Pod
metadata:
name: security-context-demo-2
spec:
securityContext:
runAsUser: 1000
containers:
- name: sec-ctx-demo-2
image: gcr.io/google-samples/node-hello:1.0
securityContext:
runAsUser: 0
privileged: True
allowPrivilegeEscalation: false
Fixing two fields present in the file being prominent security best practice issues
Don't add or remove configuration settings; only modify the existing configuration settings
Whenever you need an unprivileged user for any of the tasks, use user test-user with the user id 5487
Suggested Answer: A
Get Premium CKS Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
34 comments · newest first
JA
Jamal
11 months ago
Is it really necessary to use a specific user ID like 5487? Sounds odd.
DE
Denny
12 months ago
I think the `privileged: True` setting is a huge red flag.
OR
Orville
12 months ago
Wait, why is `runAsUser` set to 0 in the manifest? That's risky!
BL
Blondell
1 year ago
Totally agree, using `USER ROOT` is a bad practice!
HI
Hillary
1 year ago
The Dockerfile should use `apt-get install` instead of `apt-install`.
AI
Aileen
1 year ago
I think I’ve seen similar questions where we had to adjust security contexts, but I’m not clear on whether I should keep allowPrivilegeEscalation as false or change it based on the user ID.
RE
Reita
1 year ago
For the Kubernetes manifest, I recall we practiced changing the runAsUser to a non-zero value, but I’m not sure if I should set it to 5487 directly or just remove the privileged setting.
EA
Earleen
1 year ago
I’m a bit unsure about the apt-install command; I think it should be apt-get install instead. It seems like a common mistake in practice questions.
VE
Veronika
1 year ago
I remember we discussed the importance of using a non-root user in Dockerfiles to enhance security, so I think I need to change the USER ROOT line.
LA
Lasandra
1 year ago
Hmm, this seems like a tricky one. I know Tanzu Kubernetes Grid Service supports some CNI plugins, but I'm not totally sure which ones. I'll have to review my notes on that.
NE
Nell
1 year ago
Okay, let me think this through. The cases need to be organized by status, with Escalated first, then Active, then Closed. I'm pretty sure the States with conditions to filter by case status option is the way to go here.
BE
Bette
1 year ago
Well, well, well, looks like someone's got a penchant for playing with fire! 'apt-install' and 'USER ROOT'? Might as well just hand the keys to the kingdom over to the container and call it a day. And the deployment file? Privilege escalation and root access? Might as well just throw the whole server out the window and start over!
EL
Eladia
1 year ago
User 4: Definitely, those need to be fixed asap before any serious security breaches occur.
TU
Tuyet
1 year ago
User 3: And in the deployment manifest file, privilege escalation and root access? That's a disaster waiting to happen.
TE
Telma
1 year ago
User 2: I know, those are big no-nos. It's like giving full control to the container.
FR
Frederic
1 year ago
User 1: Yikes, 'apt-install' and 'USER ROOT' in the Dockerfile? That's a major security risk.
KI
Kindra
1 year ago
The Dockerfile needs to be fixed by correcting the 'apt-install' instruction and removing the 'USER ROOT' line. In the deployment manifest, the 'runAsUser: 0' and 'privileged: True' fields should be changed to use a non-root user for better security.
RU
Rusty
1 year ago
In the deployment manifest, we need to update 'runAsUser: 0' to use a non-root user.
KA
Kasandra
1 year ago
We should also remove the 'USER ROOT' line for security reasons.
HI
Hildegarde
1 year ago
Let's change 'apt-install' to 'apt-get install' in the Dockerfile.
AL
Allene
2 years ago
Haha, the Dockerfile is a real mess! 'apt-install'? Really? And running as root? Might as well just give the container the keys to the kingdom! As for the deployment file, oh boy, privilege escalation and root access? Might as well just hand over the entire server to the container!
CH
Chauncey
1 year ago
User 3: I agree, running as an unprivileged user with a specific user id is a much better approach.
MO
Mohammad
1 year ago
User 2: Absolutely, security best practices are essential. And that deployment manifest file is a disaster too.
HE
Helaine
1 year ago
User 1: Yeah, that Dockerfile needs some serious fixing. Running as root is a big no-no.
DI
Dianne
2 years ago
The deployment manifest file has some security issues. The 'runAsUser: 0' and 'privileged: True' fields give the container root privileges, which is not recommended for security reasons.
NA
Nathalie
2 years ago
I modified the Dockerfile to use debian:latest and added htop installation for better security.
FE
Felicidad
2 years ago
The first Dockerfile instruction has a typo in 'apt-install' instead of 'apt-get install'. Also, the 'USER ROOT' instruction is a security risk, it's better to run the container as a non-root user.
CA
Candra
1 year ago
User 2
RO
Roxane
1 year ago
User 1
LI
Lisha
2 years ago
I agree, it required careful analysis and editing to fix the security issues.
NA
Nathalie
2 years ago
I found the Dockerfile and deployment manifest file question tricky.
CA
Carmela
2 years ago
I believe modifying the deployment manifest file is also crucial for security. We need to fix those fields.
ED
Edda
2 years ago
I agree, we should analyze and edit the Dockerfile to ensure best security practices.
AU
Augustine
2 years ago
I think the Dockerfile needs to be edited to fix security issues.