feat(lab9): falco custom rules + conftest hardening policies

[demonit4028]

Goal

Falco runtime detection with custom rules + Conftest policy-as-code for K8s hardening.

Changes

• labs/lab9/falco/rules/custom-rules.yaml — custom Falco rule (Write to /tmp) + bonus cryptominer detection rule
• labs/lab9/policies/extra/hardening.rego — Conftest Rego policies (runAsNonRoot, allowPrivilegeEscalation, capabilities.drop ALL, resources.limits.memory)
• submissions/lab9.md — submission with triggered alerts, policy outputs, and reflections

Testing

# Falco — Terminal shell (baseline A)
docker exec -it lab9-target /bin/sh -lc 'echo "shell-in-container test"'

# Falco — Read sensitive file (baseline B)
docker exec lab9-target /bin/sh -lc 'cat /etc/shadow'

# Falco — Custom rule: Write to /tmp
docker exec --user 0 lab9-target /bin/sh -lc 'echo "test" > /tmp/my-write.txt'

# Falco — Bonus: Cryptominer detection
docker exec lab9-target /bin/sh -c 'nc -w 2 127.0.0.1 3333' 2>/dev/null || true

# Conftest — hardened manifest passes
conftest test labs/lab9/manifests/k8s/juice-hardened.yaml --policy labs/lab9/policies/extra/
# → 8 tests, 8 passed, 0 failures

# Conftest — unhardened manifest fails
conftest test labs/lab9/manifests/k8s/juice-unhardened.yaml --policy labs/lab9/policies/extra/
# → 3 failures: runAsNonRoot, allowPrivilegeEscalation, resources.limits.memory

# Conftest — compose policy (shipped)
conftest test labs/lab9/manifests/compose/juice-compose.yml \
  --policy labs/lab9/policies/compose-security.rego --namespace compose.security
# → 4 tests, 4 passed

conftest test /tmp/bad-compose.yml \
  --policy labs/lab9/policies/compose-security.rego --namespace compose.security
# → 2 failures: user, read_only

Artifacts & Screenshots

• submissions/lab9.md

---

Checklist

• Title follows feat(labN): <topic> format
• No secrets or large temp files committed
• Submission file at submissions/lab9.md exists