Operation Paper Walls

HOME LAB · LINUX · difficulty 5 · ~40 min · 20 steps

Twelve containers, one reverse proxy, and one bind mount that made all of it optional.

Briefing

You run everything on one Debian box: media, notes, photos, a git server, a dozen containers behind Caddy with real certificates. It has worked for years. This morning the box is warm, the fans are up, and there is a container running that you did not start. It has a name you have never typed. Containers are not a security boundary. They are a packaging format with namespaces around it. Find out how thin the walls actually were.

Objectives

• Inventory what is exposed and what is running
• Find the container nobody created and prove what it can reach
• Trace it back to the bind mount that made it possible
• Preserve evidence before you destroy anything
• Find and remove what it left on the host itself

Return to the range lobby