Lab 02 — IMDS & Container Escape Analyzer
Operation Cedar Lattice, Phase 09. The EKS node in Meridian Freight's production cluster has a misconfigured pod. Your job is to implement an analyzer that inspects synthetic configuration facts — IMDS settings and container runtime flags — and produces a prioritized findings list with the Falco rule or CloudTrail event that detects each issue.
Safety boundary. This lab operates entirely on Python dictionaries representing configuration metadata. No real containers are launched. No real IMDS calls are made. No exploit code. Analysis only.
Objective
Implement four functions in lab.py:
| Function | Description |
|---|---|
imds_findings(facts) | Detect IMDSv1 and weak hop-limit configurations |
container_escape_findings(facts) | Detect escape-enabling container misconfigurations |
analyze(facts) | Combine findings, sort by severity, determine overall risk level |
detection_for_finding(finding) | Return Falco rule or CloudTrail event for a finding |
Facts Format
facts = {
"imds_version": "v1", # "v1" or "v2"
"imds_hop_limit": 1, # integer, default 1 (only relevant for v2)
"container_flags": ["--privileged", "--pid=host"],
"capabilities": ["cap_sys_admin", "cap_net_admin"],
"volumes": ["/var/run/docker.sock:/var/run/docker.sock", "/data:/data:ro"],
"host_network": True,
}
Finding Format
Each finding is a dict:
{
"id": "privileged_container", # string identifier
"severity": "CRITICAL", # CRITICAL | HIGH | MEDIUM | LOW
"title": "Privileged container detected",
"description": "Container launched with --privileged flag ..."
}
Severity Ordering
For sorting and risk level determination:
| Severity | Order |
|---|---|
| CRITICAL | 0 (highest) |
| HIGH | 1 |
| MEDIUM | 2 |
| LOW | 3 |
analyze sets risk_level to the highest severity present across all findings.
Running the Lab
pip install -r requirements.txt
# Run your implementation (should raise NotImplementedError):
pytest -q
# Run reference solution:
LAB_MODULE=solution pytest -q
Deliverable
When all 11 tests pass with LAB_MODULE=solution pytest -q, you can:
- Identify IMDS misconfigurations and their severity from configuration facts
- Identify container escape vectors from runtime flags, capabilities, and volume mounts
- Aggregate and prioritize findings by severity
- Map each finding to its Falco rule or CloudTrail event for the detection report