New open-source Docker security labs cover AI context poisoning

OpsCart Labs' Docker Security guide is a practical resource for teams wrestling with container security in production. Instead of just theory, it offers reproducible labs that mirror real-world attack scenarios, such as Docker socket exposure, privileged containers, and misconfigured seccomp profiles. The progression from CIS-aligned checks to supply-chain trust and runtime defense gives engineers a structured path to harden their environments, which is especially valuable for auditors and platform teams who need evidence-based validation.

The inclusion of AI-specific labs (06, 11, and 13) reflects the growing concern about securing machine learning workloads and AI agents. Lab 11, for instance, builds an AutoGen-based agent that uses GPT-3.5-turbo to remediate container issues, protected by HMAC authentication and rate limiting. Lab 13 tests defenses against context poisoning by injecting zero-width Unicode instructions into controlled projects, comparing how Claude Code and Gemini CLI behave, and validating Docker Sandboxes as an infrastructure-level defense. This practical angle helps teams understand both agent-layer detection and sandbox-level isolation.

The guide also emphasizes reproducibility, with scripts, configurations, and captured experiment evidence for each lab. It is part of OpsCart Labs, a collection of open-source labs informed by production cloud and Kubernetes operations. The estimated total time of 14–17 hours is a commitment, but the modular design lets users pick labs based on their threat model, making it a flexible addition to security training and compliance readiness.