Cloud and Container Security Fundamentals

Throughout this course "the server" has been a single box. In 2026 that box is almost never bare metal you can point at. The application is packaged into a container image, the image runs as a container on a host you do not own, and that host lives in a cloud account governed by an identity policy.

None of this removes the vulnerabilities you already know — SQL injection, cross-site scripting, SSRF, and broken access control are all still present. What it adds is a layer of deployment misconfigurations on top, and it changes the impact of some bugs dramatically. A server-side request forgery that was once a minor information leak becomes, on a cloud host, a path to the credentials for the entire account.

A quick vocabulary, because the difference is security-critical:

An image is a read-only, layered template — a filesystem snapshot plus metadata. Anything baked into a layer is readable by anyone who can pull the image.
A container is a running instance of an image: a process on the host, isolated by kernel features so it appears to have its own filesystem and network.

Prerequisites: ssrf-file-upload for the metadata pivot, security-misconfig-exposed-files for deployment exposure, and testing-lab-docker-kali for local container practice. This lesson connects those ideas to cloud blast radius; it does not require probing a real cloud account.

In this lesson you will:

See why secrets must never be baked into an image, and where they should live instead.
Connect ssrf-file-upload to the cloud instance-metadata endpoint — the single most important pivot in cloud security — and name its address.
Understand the shared-responsibility model: which risks are the provider's and which are yours.
Reason about why a container shares the host kernel, making it a weak trust boundary that must be run with least privilege.

This lesson sits under A05:2021 - Security Misconfiguration and draws on the CIS Docker Benchmark and NIST SP 800-190. It builds directly on ssrf-file-upload.

Estimated time: 10 to 15 minutes.

When you are ready, send the Continue signal.

A quick vocabulary, because the difference is security-critical:

An image is a read-only, layered template — a filesystem snapshot plus metadata. Anything baked into a layer is readable by anyone who can pull the image.
A container is a running instance of an image: a process on the host, isolated by kernel features so it appears to have its own filesystem and network.

In this lesson you will:

See why secrets must never be baked into an image, and where they should live instead.
Connect ssrf-file-upload to the cloud instance-metadata endpoint — the single most important pivot in cloud security — and name its address.
Understand the shared-responsibility model: which risks are the provider's and which are yours.
Reason about why a container shares the host kernel, making it a weak trust boundary that must be run with least privilege.

This lesson sits under A05:2021 - Security Misconfiguration and draws on the CIS Docker Benchmark and NIST SP 800-190. It builds directly on ssrf-file-upload.

Estimated time: 10 to 15 minutes.

When you are ready, send the Continue signal.