DevSecOps › Module 8 › Lesson 1
Runtime Named
Runtime security literacy — admission control, read-only rootfs, network policy stub, runtime threat detection, least-privilege service account — named rows on YOUR `$DEVSEC_LAB` deploy stubs.
Visual · t36_runtime_named
Runtime = named deploy guard rows. $DEVSEC_LAB. Original Cyberlium.
Opening
Build-time scans miss runtime drift — name admission control and network policy rows on YOUR lab deploy stubs before tampering with stranger org clusters.
Runtime named literacy names: admission control policy category (OPA/Gatekeeper literacy stub), read-only root filesystem category, network policy stub category, runtime threat detection category (Falco literacy stub), and least-privilege service account category. Analyst documents runtime guard card on `$DEVSEC_LAB` lab deploy manifest — five rows with pass/fail literacy — without modifying stranger org Kubernetes clusters, without deploying crypto-miners as 'runtime test,' without bypassing admission control on prod without ticket. Cyberlium teaches runtime vocabulary on YOUR notes — defender deploy literacy. Refused: stranger cluster tampering, malicious runtime payloads, unauthorized prod deploy. Lab row: runtime guard card (five rows, manifest link, pass/fail stub).
1. Named runtime rows
Admission control, read-only rootfs, network policy, runtime detection, service account — five literacy anchors.
Each row cites YOUR lab manifest — not generic K8s hardening blog.
Command guide
Try these commands — Named runtime rows
═══ DOCKER & CONTAINER AUDIT ═══
Check container running state and port bindings
Command — copy this
docker ps --format "table {{.ID}} {{.Image}} {{.Status}} {{.Ports}}" 2>/dev/null || echo "docker ps"Inspect container for elevated capabilities and root user
Command — copy this
docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || trueRun security vulnerability scan on container image using Trivy
Command — copy this
trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"
═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace
Command — copy this
kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"
Primary tools to practice this lesson: curl, grep. Reference sites: NIST SSDF PS.2 (https://csrc.nist.gov/Projects/ssdf); CISA SBOM (https://www.cisa.gov/sbom); CISA Secure by Design (https://www.cisa.gov/securebydesign). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Build vs runtime split
Module 7 scans at build — runtime guards catch drift and live threats.
Link Module 7 CI gate — complementary not duplicate literacy.
3. Refused
No stranger cluster modifications; no malicious runtime payloads; no prod bypass without ticket.
Runtime literacy supports YOUR deploy hygiene — not cluster sabotage.
4. What you ship: runtime guard card
Five runtime rows + manifest link + pass/fail stub + NEVER stranger cluster tamper line.
5. What you record before the next lesson
Runtime guard card path.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Deploy test crypto-miner pod on stranger org leaked kubeconfig as 'runtime detection research.'
Right
Runtime guard card from `$DEVSEC_LAB` deploy stub. Next: SBOM Named.
Mission: runtime guard card
1) Name five runtime literacy rows. 2) Map each to lab manifest stub. 3) Pass/fail criteria per row. 4) Write NEVER stranger cluster tamper line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Admission control vs network policy — literacy split?”
Knowledge Check
APPLY: Runtime literacy on Cyberlium uses:
Multiple choice
Knowledge Check
APPLY: True or False: Stranger cluster modifications are course lab.
True or False
Knowledge Check
APPLY: Runtime guard card includes:
Multiple choice