Goal

Detect suspicious container behavior with Falco and enforce deployment hardening via policy-as-code using Conftest (Rego) — all runnable locally.

Changes

Added labs/lab9/analysis/conftest-compose.txt
Added labs/lab9/analysis/conftest-hardened.txt
Added labs/lab9/analysis/conftest-unhardened.txt
Added labs/lab9/falco/logs/falco.log
Added labs/lab9/falco/rules/custom-rules.yaml
Added labs/lab9/submission9.md

Testing

No testing

Artifacts & Screenshots

labs/lab9
├── analysis
│   ├── conftest-compose.txt
│   ├── conftest-hardened.txt
│   └── conftest-unhardened.txt
├── falco
│   ├── logs
│   │   └── falco.log
│   └── rules
│       └── custom-rules.yaml
├── manifests
│   ├── compose
│   │   └── juice-compose.yml
│   └── k8s
│       ├── juice-hardened.yaml
│       └── juice-unhardened.yaml
├── policies
│   ├── compose-security.rego
│   └── k8s-security.rego
└── submission9.md

Checklist

• Task 1 — Falco runtime detection (alerts + custom rule)
• Task 2 — Conftest policies (fail→pass hardening)
• PR has a clear and descriptive title
• Documentation has been updated if necessary
• No sensitive data or large temporary files have been committed