Answering a Zero-Day with an SBOM
By Richard Augenti
Generate SBOMs for a set of build artifacts and use them to answer, in minutes rather than days, which deployed services contain a newly disclosed vulnerable component.
Free to browse. Takes about 45 minutes once you start.
Lab Overview
It is the morning a critical vulnerability is announced in a widely used library. Your platform is a monorepo of five services, each with its own dependencies. The only question that matters in the next ten minutes is which of them ship the package.
In this lab you build the inventory that answers it - a CycloneDX Software Bill of Materials per service, generated with Syft - use it to scope the blast radius, confirm exploitability with Grype, and remediate only what is actually affected. Then you wire SBOM generation into the pipeline, because an inventory is only useful while it is current.
Everything runs locally on the lab machine. Syft and Grype run as containers and the vulnerability data is already on the box.
What to Expect
- Environment: a single Ubuntu machine you connect to over SSH, with the five-service monorepo in place. Syft and Grype run as containers and jq is on the path. No cluster required.
- Access: SSH credentials are generated for your session and shown in the workspace. They are destroyed when the lab ends.
- Checking your work: verify.sh machine-checks each objective, and setup.sh --force rebuilds the lab from scratch if you want to start over.
- Progress: your work is not saved. If the lab expires or you quit, the machine and everything on it is destroyed.
What are hands-on labs?
A lab is a real environment, not a simulation. You get a live machine with the tooling already installed, a task taken from production work, and root access to take it apart. Nothing is mocked, nothing is multiple choice. It either works or it doesn't.
Real tooling
The same commands you would run at work, on a machine that is already set up for them. No screenshots, no sandboxed toy version.
Break it freely
Everything is disposable. When the clock runs out the environment is destroyed with everything in it, so there is no reason to be careful.
Useful on Monday
Built by engineers who run these systems in production. Skills you can apply to your own stack the same week, not exam preparation.