{"type":"doc","content":[{"type":"heading","attrs":{"level":2},"content":[{"type":"text","text":"Welcome, Security Engineers! 🛡️"}]},{"type":"paragraph","content":[{"type":"text","text":"You've just joined the most hands-on Docker & Kubernetes security training on the internet. Here's what you're getting:"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"type":"text","marks":[{"type":"bold"}],"text":"15 in-depth lessons"},{"type":"text","text":" covering every OWASP Top 10 vulnerability with real container exploits and defenses"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"type":"text","marks":[{"type":"bold"}],"text":"Hands-on labs"},{"type":"text","text":" — Dockerfiles, K8s YAML manifests, and attack simulations you can run locally"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"type":"text","marks":[{"type":"bold"}],"text":"Production checklists"},{"type":"text","text":" — battle-tested hardening guides for real infrastructure"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"type":"text","marks":[{"type":"bold"}],"text":"Certificate of completion"},{"type":"text","text":" — finish all 15 lessons and earn your SecureStack credential"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"type":"text","marks":[{"type":"bold"}],"text":"Community chat"},{"type":"text","text":" — connect with other security-minded engineers"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"text","text":"How to Get Started"}]},{"type":"orderedList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"type":"text","text":"Head to the course and start with Module 1: Container & Orchestration Foundations"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"type":"text","text":"Follow lessons in order — each one builds on the last"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"type":"text","text":"Drop into community chat if you get stuck or want to discuss a concept"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"type":"text","text":"Check the Updates & Resources feed for new tools and announcements"}]}]}]},{"type":"paragraph","content":[{"type":"text","text":"Let's lock down some infrastructure. See you in Module 1. 🚀"}]}]}

{"type":"doc","content":[{"type":"paragraph","content":[{"type":"text","text":"I've audited hundreds of Dockerfiles and K8s clusters. These 5 mistakes show up in almost every single one — and they're exactly what attackers look for."}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"text","text":"1. Running Containers as Root"}]},{"type":"paragraph","content":[{"type":"text","text":"If your Dockerfile doesn't have a USER instruction, your app runs as root inside the container. A single container escape gives the attacker root on the host. Fix: always create and switch to a non-root user."}]},{"type":"codeBlock","attrs":{"language":"dockerfile"},"content":[{"type":"text","text":"RUN addgroup -S app && adduser -S app -G app\nUSER app"}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"text","text":"2. Using latest Tags in Production"}]},{"type":"paragraph","content":[{"type":"text","text":"The :latest tag is mutable. Anyone who compromises the upstream image can inject malicious code into your next deployment. Pin your images to a specific digest or version tag and verify with cosign."}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"text","text":"3. Exposing the Docker Socket"}]},{"type":"paragraph","content":[{"type":"text","text":"Mounting /var/run/docker.sock into a container gives that container full control of the Docker daemon — equivalent to root on the host. This is the #1 container escape vector. Never mount the socket unless absolutely necessary, and if you must, use a socket proxy with strict filtering."}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"text","text":"4. No Network Policies in Kubernetes"}]},{"type":"paragraph","content":[{"type":"text","text":"By default, every pod can talk to every other pod. An attacker who compromises one service can laterally move across your entire cluster. Deploy NetworkPolicies to enforce least-privilege pod-to-pod communication from day one."}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"text","text":"5. Secrets in Environment Variables"}]},{"type":"paragraph","content":[{"type":"text","text":"Environment variables are visible in docker inspect, process listings, and crash dumps. Use Docker secrets, K8s Secrets (with encryption at rest), or an external vault like HashiCorp Vault."}]},{"type":"paragraph","content":[{"type":"text","marks":[{"type":"bold"}],"text":"These are just the basics."},{"type":"text","text":" Inside SecureStack Academy, I break down all 10 OWASP categories with live exploit demos, hardened Dockerfiles, K8s manifests, and production-ready checklists across 15 detailed lessons. If you're serious about container security, this is the course."}]}]}