A container image should not contain live credentials. Secret handling, workload permissions and image provenance need deliberate controls and authorized testing.
Before you begin
Know basic containers and use an authorized local or disposable training cluster. Do not experiment on an unapproved production workload.
Work through the idea
Start from one known working service and record its resource, configuration and health requirements. Test an intentional failure in a controlled environment and describe recovery. Keep credentials out of the manifest and repository. Distinguish what orchestration provides from what the application must implement itself.
- Keep secrets outside source and images
- Use minimum workload permissions
- Review image and dependency updates
Practice task
Inspect a fictional deployment manifest for a hardcoded token and an unnecessarily privileged setting.
Check your result
Propose corrections and a credential-rotation plan without displaying any real secret.
A mistake to avoid
Do not assume that encoding a secret makes it encrypted or safe to publish.
Keep a review note
Save the inputs or scenario, your reasoning and the result you checked. Explain one assumption and one case that needs more work. Revise the exercise after feedback and distinguish what you demonstrated from what remains untested.
Official reference for further study
Explore the related learning path · Choose another worksheet