# Tutorial: cloud-native decoy walkthrough

**Audience:** operators enabling IMDS / K8s / Docker / OCI / OAuth device-code
surfaces in a lab  
**Time:** ~25-40 min

## Prerequisites

- Built `bin/sensor` (or `cd engine && go build -o ../bin/sensor ./cmd/sensor`)
- Read [cloud-native-decoys.md](../how-to/cloud-native-decoys.md) safety notes
- Loopback-only for first run

## Steps

1. Start the sensor with Phase 7 listens on loopback (see how-to).
2. Confirm IMDS v2-strict: unauthenticated GET → 401; token PUT then GET → 200.
3. List K8s pods / secrets (secrets `data` empty).
4. `GET /_ping` on Docker TCP decoy; confirm create/exec → 403.
5. Pull an OCI manifest; confirm empty layers and an observation fact.
6. Hit OAuth `/.well-known/openid-configuration` and `/devicecode`.
7. Run focused tests or `make purple-team`.

## Checklist

- [ ] No bind of `169.254.169.254`
- [ ] No docker.sock / SA mounts
- [ ] Tokens/credentials are synthetic (`ASIADECOY`, `decoy_*`)
- [ ] Purple-team green for enabled surfaces
- [ ] Internet-bind still NOT CLEARED without production-signoff

## Next

- [OAuth device-code how-to](../how-to/oauth-device-code-decoy.md)
- [Catch a stolen cloud key](catch-a-stolen-cloud-key.md) (Ops Plugins)