Challenges | iximiuz Labs

This challenge was created by a community author. Community content is reviewed by the iximiuz Labs team on a best effort basis.

Challenge on Security

Harden a Django GraphQL API: Five Classic Flaws

by Adam Leskis

A stock Django + Strawberry GraphQL service ships with five common weaknesses. Probe each one from the terminal, fix it in the real project, and watch the lab confirm the remediation against the live endpoint.

#graphql #django #strawberry #appsec

This challenge was prepared for you by the iximiuz Labs team.

Challenge on Containers, Networking, Security

Docker 101: Publish a Redis Container Port on the Private Network Only

by Ivan Velichko

A common setup for small deployments: two servers (VM or bare-metal), each with a public and a private IP. The app listens on the public port but wants to talk to Redis over the private network. Can you set it up?

#docker #containers-101 #container-networking #port-forwarding

This challenge was created by a community author. Community content is reviewed by the iximiuz Labs team on a best effort basis.

Challenge on Kubernetes, Networking, Security

Pick and Deploy the Least Permissive NetworkPolicy

by Omkar Shelke

The security team left five NetworkPolicy files on the workstation. Only one of them lets the frontend reach the backend while granting nothing more. Identify it and deploy it, unchanged.

#cka #ckad #cks #network-policy

This challenge was created by a community author. Community content is reviewed by the iximiuz Labs team on a best effort basis.

Challenge on Kubernetes, Security

Expose the Snake Game via TLS Ingress

by Omkar Shelke

A Snake game Deployment and ClusterIP Service are already running in the snake namespace. Create a Traefik Ingress that serves the game over HTTPS using an existing cert-manager-issued TLS Secret.

#cka #ckad #ingress #tls #traefik

This challenge was created by a community author. Community content is reviewed by the iximiuz Labs team on a best effort basis.

Challenge on Kubernetes, Security

Enforce TLSv1.3-Only Policy on a Production NGINX Deployment

by Omkar Shelke

Update a production NGINX ConfigMap to restrict TLS to v1.3 only, then verify the change enforces the security policy.

#cka #ckad #tls #configmap #deployment

This challenge was created by a community author. Community content is reviewed by the iximiuz Labs team on a best effort basis.

Challenge on Kubernetes, Security

Verify Kernel Isolation Between Kata Containers and runc Using RuntimeClass

by Omkar Shelke

Prove that Kata Containers Pods run inside a dedicated VM with a separate guest kernel, completely isolated from the host kernel, by comparing kernel versions across runc and Kata runtimes.

#cks #runtimeclass #kata-containers #sandbox #isolation

This challenge was carefully crafted by an independent author and proudly hosted by iximiuz Labs.

Challenge on CI/CD, Security

Dagger: Working with Secrets

by Márk Sági-Kazár

Get hands-on with reading secrets from different providers and using them in your Dagger pipelines.

#dagger