Lab 02 — IMDS & Container Escape Analyzer

Operation Cedar Lattice, Phase 09. The EKS node in Meridian Freight's production cluster has a misconfigured pod. Your job is to implement an analyzer that inspects synthetic configuration facts — IMDS settings and container runtime flags — and produces a prioritized findings list with the Falco rule or CloudTrail event that detects each issue.

Safety boundary. This lab operates entirely on Python dictionaries representing configuration metadata. No real containers are launched. No real IMDS calls are made. No exploit code. Analysis only.


Objective

Implement four functions in lab.py:

FunctionDescription
imds_findings(facts)Detect IMDSv1 and weak hop-limit configurations
container_escape_findings(facts)Detect escape-enabling container misconfigurations
analyze(facts)Combine findings, sort by severity, determine overall risk level
detection_for_finding(finding)Return Falco rule or CloudTrail event for a finding

Facts Format

facts = {
    "imds_version": "v1",            # "v1" or "v2"
    "imds_hop_limit": 1,             # integer, default 1 (only relevant for v2)
    "container_flags": ["--privileged", "--pid=host"],
    "capabilities": ["cap_sys_admin", "cap_net_admin"],
    "volumes": ["/var/run/docker.sock:/var/run/docker.sock", "/data:/data:ro"],
    "host_network": True,
}

Finding Format

Each finding is a dict:

{
    "id": "privileged_container",   # string identifier
    "severity": "CRITICAL",         # CRITICAL | HIGH | MEDIUM | LOW
    "title": "Privileged container detected",
    "description": "Container launched with --privileged flag ..."
}

Severity Ordering

For sorting and risk level determination:

SeverityOrder
CRITICAL0 (highest)
HIGH1
MEDIUM2
LOW3

analyze sets risk_level to the highest severity present across all findings.


Running the Lab

pip install -r requirements.txt

# Run your implementation (should raise NotImplementedError):
pytest -q

# Run reference solution:
LAB_MODULE=solution pytest -q

Deliverable

When all 11 tests pass with LAB_MODULE=solution pytest -q, you can:

  • Identify IMDS misconfigurations and their severity from configuration facts
  • Identify container escape vectors from runtime flags, capabilities, and volume mounts
  • Aggregate and prioritize findings by severity
  • Map each finding to its Falco rule or CloudTrail event for the detection report

« Lab 01: Cloud IAM Attack Path | Phase 09 README »