01
Attacker
dokuru-lab-baseline
A vulnerable default-root web app with bind mounts. Upload and command-injection bugs become host-root evidence when userns-remap is off.
/ws/monitor /ws/terminal /ws/customer
Default Docker, one upload from host root.
Trigger payloads from dokuru-lab-baseline, then watch the neighbor service and container evidence update live.
The setup
Three Docker containers, one shared kernel
02
Neighbor
victim-checkout
A customer-facing API that should stay responsive while the baseline app tries to consume unconstrained CPU, memory, and PIDs.
03
Signal
customer-traffic
An out-of-band probe that hits checkout on a loop. Its latency feed is the visible blast-radius signal for the cgroup demo.
signal measures blast radius after every payload