Lab
Secure Docker Images with Trivy
Build a deliberately weak image, scan it with Trivy, and rebuild it until the gate for fixable HIGH and CRITICAL findings passes: current base, non-root user, patched packages, no pip in the runtime image.
Path 01 · learning path
DevSecOps Pipeline
Building a delivery pipeline with security gates that developers can live with: secrets detection, SAST, image scanning and controlled deployment, in Jenkins and GitLab CI.
What you will learn
- Stop credentials at the pre-commit hook and again in CI, and handle a real finding without spreading it
- Run quality and security gates in parallel and verify the built artifact before anything deploys
- Keep one deployment owner, whether that is a protected-branch job or the platform’s Git integration
- Give Jenkins the same shape with an ephemeral agent and least-privilege credentials
Before you start
Knowledge assumed
- Git and the shape of a CI pipeline: stages, jobs, artifacts (the CI/CD Engineering path covers it, but is not required)
- Comfort reading YAML and a Jenkinsfile
Hands-on environment
- A GitLab.com project; the Jenkins part needs a Jenkins 2.5xx LTS with Docker
- Docker, to run the scanners locally
Each part names what it needs. Nothing has to be installed before part 1.
The path
3 parts, in order
Each part states what it assumes from the previous one, so you can also jump in where your setup already is.
- Part 1 of 3 Start here
Secrets Detection with Gitleaks
Stop credentials from reaching Git: run Gitleaks in pre-commit hooks and CI, tune rules and allowlists, handle findings without leaking them further, and decide when history rewriting is worth it.
- Part 2 of 3
A GitLab CI/CD Security Pipeline That Developers Do Not Route Around
The GitLab pipeline that gated this site while it ran CI: frozen installs, parallel quality gates, Trivy with SAST and secret detection, artifact verification, and one deployment owner behind protected main.
- Part 3 of 3
Building a Secure CI/CD Pipeline with Jenkins
A declarative Jenkins pipeline with secrets scanning, SAST, image scanning and least-privilege credential handling — and the agent, plugin and Docker decisions that keep it that way.
Practise
Labs that exercise this path
Lab
Scan Git Repositories with Gitleaks
Seed a repository with realistic fake secrets, catch them with Gitleaks in history and working-tree modes, ignore a confirmed false positive by fingerprint, and block the next one at commit time.
Lab
Generate an SBOM with Syft and Scan It with Grype
Produce CycloneDX and SPDX bills of materials for a container image without a Docker socket, scan the SBOM with Grype, gate on fixable findings only, and see why the SBOM is worth keeping after the release.
Toolchain
Tool profiles used in this path
secure
Gitleaks
Detects hard-coded secrets in Git history and working trees.
build
Jenkins
Self-hosted automation server with pipelines as code and a large plugin ecosystem.
secure
Trivy
All-in-one scanner for container images, filesystems, IaC, Kubernetes and SBOMs.
secure
Semgrep
Fast, pattern-based static analysis with thousands of community and security rules.
code
GitLab
Source control, merge requests and CI/CD in one platform, with built-in security scanning templates.
After the last part
Where to go next
Two paths pick up where this one stops. Either order works; neither is required.
- Path 02
Container Security
Scan images, produce SBOMs and ship less, from Dockerfile to registry.
- Path 05
Infrastructure as Code Security
Catch insecure Terraform before it is applied: foundations, Checkov scanning and a merge-request gate.