Feature/lab9

[fayz131]

Goal

Complete Lab 9 by implementing runtime container monitoring with Falco and enforcing security policies with Conftest (OPA/Rego)

Changes

• Added lab report: labs/submission9.md
• Added custom Falco rule: labs/lab9/falco/rules/custom-rules.yaml
• Added Falco alert evidence and runtime monitoring results
• Added Conftest analysis outputs:
  • labs/lab9/analysis/conftest-unhardened.txt
  • labs/lab9/analysis/conftest-hardened.txt
  • labs/lab9/analysis/conftest-compose.txt
• Analyzed Kubernetes and Docker Compose security policy results

Testing

Falco runtime detection

Triggered shell inside container:

docker exec -it lab9-helper /bin/sh -lc 'echo hello-from-shell'

Result:

Falco detected a terminal shell inside the container

Triggered file write under /usr/local/bin:

docker exec --user 0 lab9-helper /bin/sh -lc 'echo custom-test > /usr/local/bin/custom-rule.txt'

Result:

Falco detected container drift behavior
Custom Falco rule triggered on write under /usr/local/bin
Conftest policy checks

Unhardened Kubernetes manifest:

8 failures
2 warnings

Hardened Kubernetes manifest:

all tests passed

Docker Compose manifest:

all tests passed

Artifacts & Screenshots

Report: labs/submission9.md
Falco rule: labs/lab9/falco/rules/custom-rules.yaml
Conftest outputs:
labs/lab9/analysis/conftest-unhardened.txt
labs/lab9/analysis/conftest-hardened.txt
labs/lab9/analysis/conftest-compose.txt

---

Checklist

• PR title is clear and descriptive
• Documentation updated if needed
• No secrets, temporary files, or large binaries included