docs(02): create phase 2 plans (3 plans)

.planning/ROADMAP.md

@@ -12,7 +12,7 @@
 | Phase | Plans Complete | Status | Completed |
 |-------|----------------|--------|-----------|
 | 1. Setup & Git Foundation | 0/2 | Planning complete | - |
-| 2. Lab 01 - IAM & Sicurezza | 0/3 | Not started | - |
+| 2. Lab 01 - IAM & Sicurezza | 0/3 | Planning complete | - |
 | 3. Lab 02 - Network & VPC | 0/3 | Not started | - |
 | 4. Lab 03 - Compute & EC2 | 0/3 | Not started | - |
 | 5. Lab 04 - Storage & S3 | 0/3 | Not started | - |
@@ -80,7 +80,11 @@
 4. Lab include Tutorial passo-passo, How-to Guides, Reference, e Explanation (Framework Diátaxis completo)
 5. Studente può eseguire comando di verifica finale ("double check") per validare il lavoro svolto
 
-**Plans:** TBD
+**Plans:** 3
+
+- [ ] [02-01-PLAN.md](.planning/phases/02-lab-01-iam-sicurezza/02-01-PLAN.md) — Create test infrastructure (Wave 0: test-01-user-creation.sh, test-02-docker-access.sh, 03-non-root-test.sh, 99-final-verification.sh, run-all-tests.sh)
+- [ ] [02-02-PLAN.md](.planning/phases/02-lab-01-iam-sicurezza/02-02-PLAN.md) — Create Diátaxis documentation (Tutorial: 3 parts, How-to Guides: 3 guides, Reference: 3 documents, Explanation: IAM parallels)
+- [ ] [02-03-PLAN.md](.planning/phases/02-lab-01-iam-sicurezza/02-03-PLAN.md) — Create infrastructure (Dockerfile with non-root user, docker-compose.yml with user directive, infrastructure verification)
 
 ---
 

.planning/phases/02-lab-01-iam-sicurezza/02-01-PLAN.md

@@ -0,0 +1,808 @@
+---
+phase: 02-lab-01-iam-sicurezza
+plan: 01
+type: execute
+wave: 0
+depends_on: []
+files_modified:
+  - labs/lab-01-iam/tests/test-01-user-creation.sh
+  - labs/lab-01-iam/tests/test-02-docker-access.sh
+  - labs/lab-01-iam/tests/03-non-root-test.sh
+  - labs/lab-01-iam/tests/99-final-verification.sh
+  - labs/lab-01-iam/tests/run-all-tests.sh
+autonomous: true
+requirements: [TEST-01, TEST-05, INF-01]
+user_setup: []
+must_haves:
+  truths:
+    - "Test scripts exist and can validate user creation and Docker access"
+    - "Test scripts verify non-root container execution (INF-01)"
+    - "Final verification script runs all checks for student self-validation"
+    - "Test harness can be executed with single command"
+  artifacts:
+    - path: "labs/lab-01-iam/tests/test-01-user-creation.sh"
+      provides: "User and group creation validation"
+      min_lines: 40
+    - path: "labs/lab-01-iam/tests/test-02-docker-access.sh"
+      provides: "Docker socket access control validation"
+      min_lines: 30
+    - path: "labs/lab-01-iam/tests/03-non-root-test.sh"
+      provides: "Non-root container verification (INF-01)"
+      min_lines: 35
+    - path: "labs/lab-01-iam/tests/99-final-verification.sh"
+      provides: "Final double-check command for students"
+      min_lines: 25
+    - path: "labs/lab-01-iam/tests/run-all-tests.sh"
+      provides: "Test suite orchestration"
+      min_lines: 15
+  key_links:
+    - from: "run-all-tests.sh"
+      to: "test-01-user-creation.sh, test-02-docker-access.sh, 03-non-root-test.sh, 99-final-verification.sh"
+      via: "Sequential execution with exit code handling"
+      pattern: "bash.*tests/.*\\.sh"
+---
+
+<objective>
+Create test infrastructure following TDD methodology (RED phase first). Test scripts validate user creation, Docker socket access control, and non-root container execution before any implementation exists.
+
+Purpose: Enable Test-Driven Infrastructure (TDI) by writing failing tests first, then implementing infrastructure to make them pass.
+Output: Four test scripts (user creation, Docker access, non-root verification, final check) plus test orchestration script.
+</objective>
+
+<execution_context>
+@/home/luca/.claude/get-shit-done/workflows/execute-plan.md
+@/home/luca/.claude/get-shit-done/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/PROJECT.md
+@.planning/ROADMAP.md
+@.planning/STATE.md
+@.planning/phases/02-lab-01-iam-sicurezza/02-RESEARCH.md
+@.planning/phases/02-lab-01-iam-sicurezza/02-VALIDATION.md
+@CLAUDE.md
+
+# Key patterns from RESEARCH.md
+
+## TDD Methodology for Infrastructure
+```bash
+# RED Phase: Test should fail initially (no infrastructure exists)
+# GREEN Phase: Implement minimum infrastructure to pass tests
+# REFACTOR Phase: Optimize without breaking tests
+
+# Example test structure from RESEARCH.md:
+test_unauthorized_access() {
+    sudo useradd -m -s /bin/bash test_user 2>/dev/null || true
+    if sudo -u test_user docker ps &>/dev/null; then
+        echo "FAIL: test_user can access docker without being in docker group"
+        return 1
+    else
+        echo "PASS: test_user correctly denied access"
+        return 0
+    fi
+}
+```
+
+## INF-01 Verification Pattern
+```bash
+# From RESEARCH.md - Non-root container verification
+for service in $(docker-compose ps --services); do
+    container_name=$(docker-compose ps -q $service)
+    actual_user=$(docker exec $container_name whoami 2>/dev/null)
+    if [ "$actual_user" = "root" ]; then
+        echo "FAIL: $service running as root"
+        exit 1
+    fi
+done
+echo "PASS: All containers running as non-root"
+```
+
+## Common Pitfalls to Handle
+- Group membership requires re-login (use `groups` command for testing)
+- Test as non-privileged user (root bypasses Docker socket permissions)
+- Verify with multiple methods: `docker exec whoami`, `docker inspect`, `docker top`
+
+## Test Framework from RESEARCH.md
+- Framework: BASH (Bourne Again Shell) >= 4.0
+- No config file needed - inline test functions
+- Quick run: `bash labs/lab-01-iam/tests/quick-test.sh`
+- Full suite: `bash labs/lab-01-iam/tests/run-all-tests.sh`
+</context>
+
+<tasks>
+
+<task type="auto" tdd="true">
+  <name>Task 1: Create user creation test script</name>
+  <files>labs/lab-01-iam/tests/test-01-user-creation.sh</files>
+  <behavior>
+    - Test 1: Non-existent user returns appropriate failure
+    - Test 2: User not in docker group cannot access Docker socket
+    - Test 3: User can be added to docker group
+    - Test 4: Group membership verified with `groups` command
+  </behavior>
+  <action>
+Create test script for Linux user and group management:
+
+```bash
+#!/bin/bash
+# Test: Linux user creation and Docker group membership
+# Phase: RED - This test will fail initially (no users configured)
+
+set -euo pipefail
+
+# Color output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+pass_count=0
+fail_count=0
+
+test_user_not_exists() {
+    local user="lab01_student"
+    if id "$user" &>/dev/null; then
+        echo -e "${YELLOW}SKIP${NC}: User $user already exists"
+        return 0
+    fi
+    echo -e "${GREEN}PASS${NC}: User $user does not exist (test environment clean)"
+    ((pass_count++))
+    return 0
+}
+
+test_user_without_docker_group() {
+    local user="lab01_student"
+    # Create test user if doesn't exist
+    if ! id "$user" &>/dev/null; then
+        sudo useradd -m -s /bin/bash "$user" 2>/dev/null || true
+    fi
+
+    # Check if user is in docker group
+    if groups "$user" 2>/dev/null | grep -q docker; then
+        echo -e "${RED}FAIL${NC}: User $user is in docker group (should not be yet)"
+        ((fail_count++))
+        return 1
+    fi
+
+    echo -e "${GREEN}PASS${NC}: User $user is not in docker group"
+    ((pass_count++))
+    return 0
+}
+
+test_docker_access_denied() {
+    local user="lab01_student"
+
+    # Test that user cannot access docker socket
+    if sudo -u "$user" docker ps &>/dev/null; then
+        echo -e "${RED}FAIL${NC}: User $user can access docker without docker group membership"
+        ((fail_count++))
+        return 1
+    fi
+
+    echo -e "${GREEN}PASS${NC}: Docker access correctly denied for $user"
+    ((pass_count++))
+    return 0
+}
+
+# Run all tests
+echo "Running user creation tests..."
+echo "================================"
+test_user_not_exists
+test_user_without_docker_group
+test_docker_access_denied
+echo "================================"
+echo "Tests passed: $pass_count"
+echo "Tests failed: $fail_count"
+
+if [ $fail_count -gt 0 ]; then
+    exit 1
+fi
+exit 0
+```
+
+Key implementation points:
+- Use `groups` command to verify group membership (handles re-login issue)
+- Run Docker commands as test user with `sudo -u`
+- Test the negative case first (user without access)
+- Return proper exit codes (0=pass, 1=fail)
+  </action>
+  <verify>
+    <automated>chmod +x labs/lab-01-iam/tests/test-01-user-creation.sh && bash labs/lab-01-iam/tests/test-01-user-creation.sh</automated>
+  </verify>
+  <done>Script exists, is executable, and tests user/group creation behavior</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 2: Create Docker access control test script</name>
+  <files>labs/lab-01-iam/tests/test-02-docker-access.sh</files>
+  <behavior>
+    - Test 1: User in docker group can execute docker ps
+    - Test 2: User in docker group can run basic containers
+    - Test 3: Socket permissions are correctly set (660 or stricter)
+    - Test 4: Group membership propagation is verified
+  </behavior>
+  <action>
+Create test script for Docker socket access control:
+
+```bash
+#!/bin/bash
+# Test: Docker socket access control via group membership
+# Phase: RED - This test will fail initially (no users configured)
+
+set -euo pipefail
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+pass_count=0
+fail_count=0
+
+test_socket_permissions() {
+    local socket="/var/run/docker.sock"
+    local perms=$(stat -c "%a" "$socket" 2>/dev/null || echo "000")
+
+    # Socket should be 660 or stricter (no world-readable/writable)
+    if [ "$perms" = "660" ] || [ "$perms" = "600" ]; then
+        echo -e "${GREEN}PASS${NC}: Docker socket permissions are $perms"
+        ((pass_count++))
+        return 0
+    else
+        echo -e "${YELLOW}WARN${NC}: Docker socket permissions are $perms (expected 660)"
+        ((pass_count++))
+        return 0
+    fi
+}
+
+test_docker_group_exists() {
+    if getent group docker >/dev/null 2>&1; then
+        echo -e "${GREEN}PASS${NC}: Docker group exists"
+        ((pass_count++))
+        return 0
+    else
+        echo -e "${RED}FAIL${NC}: Docker group does not exist"
+        ((fail_count++))
+        return 1
+    fi
+}
+
+test_user_can_add_to_docker_group() {
+    local user="lab01_student"
+
+    # This test verifies the MECHANISM, not that it's done yet
+    if command -v usermod >/dev/null 2>&1; then
+        echo -e "${GREEN}PASS${NC}: usermod command available for group management"
+        ((pass_count++))
+        return 0
+    else
+        echo -e "${RED}FAIL${NC}: usermod command not available"
+        ((fail_count++))
+        return 1
+    fi
+}
+
+test_docker_accessible_by_group() {
+    # Check that docker group members can access the socket
+    local socket_group=$(stat -c "%G" /var/run/docker.sock 2>/dev/null || echo "unknown")
+
+    if [ "$socket_group" = "docker" ]; then
+        echo -e "${GREEN}PASS${NC}: Docker socket owned by docker group"
+        ((pass_count++))
+        return 0
+    else
+        echo -e "${YELLOW}WARN${NC}: Docker socket owned by $socket_group (expected docker)"
+        ((pass_count++))
+        return 0
+    fi
+}
+
+# Run all tests
+echo "Running Docker access control tests..."
+echo "======================================"
+test_socket_permissions
+test_docker_group_exists
+test_user_can_add_to_docker_group
+test_docker_accessible_by_group
+echo "======================================"
+echo "Tests passed: $pass_count"
+echo "Tests failed: $fail_count"
+
+if [ $fail_count -gt 0 ]; then
+    exit 1
+fi
+exit 0
+```
+
+Key implementation points:
+- Verify socket ownership and permissions
+- Check docker group exists
+- Validate group management commands available
+- Test mechanism for adding users to docker group
+  </action>
+  <verify>
+    <automated>chmod +x labs/lab-01-iam/tests/test-02-docker-access.sh && bash labs/lab-01-iam/tests/test-02-docker-access.sh</automated>
+  </verify>
+  <done>Script validates Docker socket access control mechanisms</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 3: Create non-root container verification script (INF-01)</name>
+  <files>labs/lab-01-iam/tests/03-non-root-test.sh</files>
+  <behavior>
+    - Test 1: Container configured with USER directive runs as non-root
+    - Test 2: docker exec whoami returns non-root user
+    - Test 3: docker inspect shows User field set
+    - Test 4: docker top shows non-root UID (not 0)
+  </behavior>
+  <action>
+Create test script for non-root container verification (INF-01 requirement):
+
+```bash
+#!/bin/bash
+# Test: Non-root container execution (INF-01 requirement)
+# Phase: RED - This test will fail initially (no containers exist)
+
+set -euo pipefail
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+pass_count=0
+fail_count=0
+
+# Container name to test
+CONTAINER_NAME="lab01-test-container"
+
+test_non_root_dockerfile_exists() {
+    local dockerfile="labs/lab-01-iam/Dockerfile.test"
+
+    if [ -f "$dockerfile" ]; then
+        echo -e "${GREEN}PASS${NC}: Test Dockerfile exists"
+        ((pass_count++))
+        return 0
+    else
+        echo -e "${YELLOW}SKIP${NC}: Test Dockerfile not created yet (expected in RED phase)"
+        ((pass_count++))
+        return 0
+    fi
+}
+
+test_container_runs_as_non_root() {
+    # Check if container exists
+    if ! docker ps -a --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then
+        echo -e "${YELLOW}SKIP${NC}: Container ${CONTAINER_NAME} does not exist yet (expected in RED phase)"
+        ((pass_count++))
+        return 0
+    fi
+
+    # Check if container is running
+    if ! docker ps --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then
+        echo -e "${YELLOW}SKIP${NC}: Container ${CONTAINER_NAME} not running"
+        ((pass_count++))
+        return 0
+    fi
+
+    # Method 1: docker exec whoami
+    local actual_user=$(docker exec "${CONTAINER_NAME}" whoami 2>/dev/null || echo "unknown")
+
+    if [ "$actual_user" = "root" ]; then
+        echo -e "${RED}FAIL${NC}: Container running as root (whoami)"
+        ((fail_count++))
+        return 1
+    elif [ "$actual_user" = "unknown" ]; then
+        echo -e "${YELLOW}SKIP${NC}: Cannot determine user (container not running or no exec)"
+        ((pass_count++))
+        return 0
+    else
+        echo -e "${GREEN}PASS${NC}: Container running as non-root user: $actual_user"
+        ((pass_count++))
+        return 0
+    fi
+}
+
+test_container_user_configured() {
+    if ! docker ps -a --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then
+        echo -e "${YELLOW}SKIP${NC}: Container not created yet"
+        ((pass_count++))
+        return 0
+    fi
+
+    # Method 2: docker inspect for User field
+    local user_config=$(docker inspect --format='{{.Config.User}}' "${CONTAINER_NAME}" 2>/dev/null || echo "")
+
+    if [ -z "$user_config" ]; then
+        # Check compose file for user directive (may override Dockerfile)
+        if [ -f "labs/lab-01-iam/docker-compose.yml" ]; then
+            if grep -q "user:" labs/lab-01-iam/docker-compose.yml; then
+                echo -e "${GREEN}PASS${NC}: User directive found in docker-compose.yml"
+                ((pass_count++))
+                return 0
+            fi
+        fi
+
+        echo -e "${YELLOW}WARN${NC}: No User directive found in Dockerfile or compose"
+        ((pass_count++))
+        return 0
+    else
+        echo -e "${GREEN}PASS${NC}: User configured in container: $user_config"
+        ((pass_count++))
+        return 0
+    fi
+}
+
+test_no_container_runs_as_root() {
+    # INF-01 requirement: NO container should run as root
+    local compose_file="labs/lab-01-iam/docker-compose.yml"
+
+    if [ ! -f "$compose_file" ]; then
+        echo -e "${YELLOW}SKIP${NC}: docker-compose.yml not created yet"
+        ((pass_count++))
+        return 0
+    fi
+
+    # Get all services from compose file
+    local services=$(docker-compose -f "$compose_file" ps --services 2>/dev/null || echo "")
+
+    if [ -z "$services" ]; then
+        echo -e "${YELLOW}SKIP${NC}: No services defined yet"
+        ((pass_count++))
+        return 0
+    fi
+
+    local root_containers=0
+    while IFS= read -r service; do
+        if [ -n "$service" ]; then
+            local container_name=$(docker-compose -f "$compose_file" ps -q "$service" 2>/dev/null || echo "")
+            if [ -n "$container_name" ]; then
+                local user=$(docker exec "$container_name" whoami 2>/dev/null || echo "unknown")
+                if [ "$user" = "root" ]; then
+                    echo -e "${RED}FAIL${NC}: Service $service running as root"
+                    ((root_containers++))
+                fi
+            fi
+        fi
+    done <<< "$services"
+
+    if [ $root_containers -gt 0 ]; then
+        echo -e "${RED}FAIL${NC}: $root_containers container(s) running as root (INF-01 violation)"
+        ((fail_count++))
+        return 1
+    else
+        echo -e "${GREEN}PASS${NC}: No containers running as root (INF-01 satisfied)"
+        ((pass_count++))
+        return 0
+    fi
+}
+
+# Run all tests
+echo "Running non-root container tests (INF-01)..."
+echo "============================================"
+test_non_root_dockerfile_exists
+test_container_runs_as_non_root
+test_container_user_configured
+test_no_container_runs_as_root
+echo "============================================"
+echo "Tests passed: $pass_count"
+echo "Tests failed: $fail_count"
+
+if [ $fail_count -gt 0 ]; then
+    exit 1
+fi
+exit 0
+```
+
+Key implementation points:
+- INF-01 requirement: NO container runs as root
+- Multiple verification methods (whoami, inspect, compose check)
+- Handle not-yet-created infrastructure gracefully (skip with warning)
+- Check all services in docker-compose.yml for compliance
+  </action>
+  <verify>
+    <automated>chmod +x labs/lab-01-iam/tests/03-non-root-test.sh && bash labs/lab-01-iam/tests/03-non-root-test.sh</automated>
+  </verify>
+  <done>Script verifies INF-01: no container runs as root</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 4: Create final verification script (double-check for students)</name>
+  <files>labs/lab-01-iam/tests/99-final-verification.sh</files>
+  <behavior>
+    - Test 1: All previous tests can be run
+    - Test 2: Student can verify their work end-to-end
+    - Test 3: Clear PASS/FAIL report for all requirements
+    - Test 4: Exit code indicates overall success/failure
+  </behavior>
+  <action>
+Create final verification script for student self-check:
+
+```bash
+#!/bin/bash
+# Final Verification: Lab 01 - IAM & Sicurezza
+# This is the "double check" command students run to verify their work
+# Usage: bash tests/99-final-verification.sh
+
+set -euo pipefail
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m'
+
+echo -e "${BLUE}========================================${NC}"
+echo -e "${BLUE}Lab 01 - IAM & Sicurezza${NC}"
+echo -e "${BLUE}Final Verification (Double Check)${NC}"
+echo -e "${BLUE}========================================${NC}"
+echo ""
+
+# Track overall results
+all_passed=true
+
+# Test 1: User and group configuration
+echo -e "${BLUE}[1/5] Checking user and group configuration...${NC}"
+if id lab01_student &>/dev/null; then
+    echo -e "  ${GREEN}✓${NC} User lab01_student exists"
+    if groups lab01_student 2>/dev/null | grep -q docker; then
+        echo -e "  ${GREEN}✓${NC} User lab01_student is in docker group"
+    else
+        echo -e "  ${RED}✗${NC} User lab01_student is NOT in docker group"
+        all_passed=false
+    fi
+else
+    echo -e "  ${YELLOW}○${NC} User lab01_student does not exist (not created yet)"
+    all_passed=false
+fi
+echo ""
+
+# Test 2: Docker access control
+echo -e "${BLUE}[2/5] Checking Docker access control...${NC}"
+if sudo -u lab01_student docker ps &>/dev/null; then
+    echo -e "  ${GREEN}✓${NC} lab01_student can access Docker socket"
+else
+    echo -e "  ${RED}✗${NC} lab01_student cannot access Docker socket"
+    echo -e "  ${YELLOW}  Hint: User may need to re-login for group membership to take effect${NC}"
+    all_passed=false
+fi
+echo ""
+
+# Test 3: Non-root container execution (INF-01)
+echo -e "${BLUE}[3/5] Checking non-root container execution (INF-01)...${NC}"
+compose_file="labs/lab-01-iam/docker-compose.yml"
+if [ ! -f "$compose_file" ]; then
+    echo -e "  ${YELLOW}○${NC} docker-compose.yml not found"
+    all_passed=false
+else
+    echo -e "  ${GREEN}✓${NC} docker-compose.yml exists"
+
+    # Check for user directive in services
+    if grep -A 10 "services:" "$compose_file" | grep -q "user:"; then
+        echo -e "  ${GREEN}✓${NC} Services configured with non-root user directive"
+    else
+        echo -e "  ${RED}✗${NC} No user directive found in docker-compose.yml"
+        all_passed=false
+    fi
+
+    # If containers are running, verify they're not root
+    if docker-compose -f "$compose_file" ps --services 2>/dev/null | grep -q .; then
+        local root_count=0
+        while IFS= read -r service; do
+            [ -z "$service" ] && continue
+            local container=$(docker-compose -f "$compose_file" ps -q "$service" 2>/dev/null || echo "")
+            if [ -n "$container" ]; then
+                local user=$(docker exec "$container" whoami 2>/dev/null || echo "unknown")
+                if [ "$user" = "root" ]; then
+                    echo -e "  ${RED}✗${NC} Service $service running as ROOT (INF-01 violation)"
+                    ((root_count++))
+                fi
+            fi
+        done <<< "$(docker-compose -f "$compose_file" ps --services 2>/dev/null)"
+
+        if [ $root_count -eq 0 ]; then
+            echo -e "  ${GREEN}✓${NC} All running containers are non-root"
+        else
+            all_passed=false
+        fi
+    else
+        echo -e "  ${YELLOW}○${NC} No containers running (start with docker-compose up)"
+    fi
+fi
+echo ""
+
+# Test 4: Documentation completeness (Diátaxis)
+echo -e "${BLUE}[4/5] Checking documentation (Diátaxis framework)...${NC}"
+doc_count=0
+for doc_type in "tutorial" "how-to-guides" "reference" "explanation"; do
+    if [ -d "labs/lab-01-iam/$doc_type" ]; then
+        local md_files=$(find "labs/lab-01-iam/$doc_type" -name "*.md" 2>/dev/null | wc -l)
+        if [ "$md_files" -gt 0 ]; then
+            echo -e "  ${GREEN}✓${NC} $doc_type: $md_files document(s)"
+            ((doc_count++))
+        else
+            echo -e "  ${YELLOW}○${NC} $doc_type: directory exists but empty"
+        fi
+    else
+        echo -e "  ${RED}✗${NC} $doc_type: missing"
+    fi
+done
+
+if [ $doc_count -eq 4 ]; then
+    echo -e "  ${GREEN}✓${NC} All 4 Diátaxis document types present"
+else
+    echo -e "  ${YELLOW}○${NC} $doc_count/4 Diátaxis document types present"
+    all_passed=false
+fi
+echo ""
+
+# Test 5: IAM parallels documentation
+echo -e "${BLUE}[5/5] Checking IAM parallels explanation...${NC}"
+explanation_file="labs/lab-01-iam/explanation/docker-iam-parallels.md"
+if [ -f "$explanation_file" ]; then
+    if grep -qi "IAM.*Linux\|Linux.*IAM" "$explanation_file"; then
+        echo -e "  ${GREEN}✓${NC} IAM parallels documented"
+    else
+        echo -e "  ${YELLOW}○${NC} Explanation exists but IAM parallels unclear"
+    fi
+
+    if grep -qi "differenza\|difference" "$explanation_file"; then
+        echo -e "  ${GREEN}✓${NC} Local vs cloud differences documented"
+    else
+        echo -e "  ${YELLOW}○${NC} Local vs cloud differences not clearly documented"
+    fi
+else
+    echo -e "  ${RED}✗${NC} IAM parallels explanation not found"
+    all_passed=false
+fi
+echo ""
+
+# Final summary
+echo -e "${BLUE}========================================${NC}"
+if [ "$all_passed" = true ]; then
+    echo -e "${GREEN}ALL CHECKS PASSED${NC}"
+    echo -e "${GREEN}Lab 01 is complete!${NC}"
+    echo -e "${BLUE}========================================${NC}"
+    exit 0
+else
+    echo -e "${RED}SOME CHECKS FAILED${NC}"
+    echo -e "${YELLOW}Review the output above and complete the missing items${NC}"
+    echo -e "${BLUE}========================================${NC}"
+    exit 1
+fi
+```
+
+Key implementation points:
+- Student-friendly double-check command
+- Clear visual indicators (✓ pass, ✗ fail, ○ skip)
+- Tests all phase requirements: LAB-01, INF-01, DOCT-01/02/03/04, PARA-01/03
+- Exit code 0 for all-pass, 1 for any failure
+- Helpful hints for common issues (re-login for group membership)
+  </action>
+  <verify>
+    <automated>chmod +x labs/lab-01-iam/tests/99-final-verification.sh && bash labs/lab-01-iam/tests/99-final-verification.sh</automated>
+  </verify>
+  <done>Student can run single command to verify all lab requirements are met</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 5: Create test orchestration script</name>
+  <files>labs/lab-01-iam/tests/run-all-tests.sh</files>
+  <behavior>
+    - Test 1: Script executes all test files in sequence
+    - Test 2: Script stops on first failure (fail-fast)
+    - Test 3: Script aggregates results and provides summary
+    - Test 4: Script can be run from project root
+  </behavior>
+  <action>
+Create test orchestration script:
+
+```bash
+#!/bin/bash
+# Test Suite Runner: Lab 01 - IAM & Sicurezza
+# Runs all tests in sequence and provides summary
+# Usage: bash labs/lab-01-iam/tests/run-all-tests.sh
+
+set -euo pipefail
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+BLUE='\033[0;34m'
+NC='\033[0m'
+
+TEST_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$TEST_DIR/../.." && pwd)"
+
+cd "$PROJECT_ROOT"
+
+echo -e "${BLUE}========================================${NC}"
+echo -e "${BLUE}Lab 01 Test Suite${NC}"
+echo -e "${BLUE}========================================${NC}"
+echo ""
+
+# Array of test files in order
+declare -a tests=(
+    "$TEST_DIR/test-01-user-creation.sh"
+    "$TEST_DIR/test-02-docker-access.sh"
+    "$TEST_DIR/03-non-root-test.sh"
+)
+
+total_tests=${#tests[@]}
+passed_tests=0
+failed_tests=0
+
+for i in "${!tests[@]}"; do
+    test_num=$((i + 1))
+    test_file="${tests[$i]}"
+    test_name=$(basename "$test_file")
+
+    echo -e "${BLUE}[$test_num/$total_tests] Running $test_name...${NC}"
+
+    if bash "$test_file"; then
+        echo -e "${GREEN}✓ PASSED${NC}"
+        echo ""
+        ((passed_tests++))
+    else
+        echo -e "${RED}✗ FAILED${NC}"
+        echo ""
+        ((failed_tests++))
+        # Fail-fast: stop on first failure
+        break
+    fi
+done
+
+# Summary
+echo -e "${BLUE}========================================${NC}"
+echo -e "${BLUE}Test Suite Summary${NC}"
+echo -e "${BLUE}========================================${NC}"
+echo "Passed: $passed_tests/$total_tests"
+echo "Failed: $failed_tests/$total_tests"
+echo ""
+
+if [ $failed_tests -eq 0 ]; then
+    echo -e "${GREEN}All tests passed!${NC}"
+    echo ""
+    echo "Run final verification:"
+    echo "  bash labs/lab-01-iam/tests/99-final-verification.sh"
+    echo -e "${BLUE}========================================${NC}"
+    exit 0
+else
+    echo -e "${RED}Some tests failed${NC}"
+    echo -e "${BLUE}========================================${NC}"
+    exit 1
+fi
+```
+
+Key implementation points:
+- Fail-fast approach (stops on first failure for TDD RED phase)
+- Executes tests in dependency order
+- Provides summary and next steps
+- Can be run from any directory (uses absolute paths)
+  </action>
+  <verify>
+    <automated>chmod +x labs/lab-01-iam/tests/run-all-tests.sh && bash labs/lab-01-iam/tests/run-all-tests.sh</automated>
+  </verify>
+  <done>Orchestration script runs all tests and provides summary</done>
+</task>
+
+</tasks>
+
+<verification>
+1. All test scripts are executable (chmod +x)
+2. Test scripts can run individually and return proper exit codes
+3. Test orchestration script executes all tests in sequence
+4. Test scripts follow TDD RED phase (will fail before implementation exists)
+5. All tests handle missing infrastructure gracefully (skip with warning)
+</verification>
+
+<success_criteria>
+1. Test infrastructure is in place before any implementation (Wave 0 complete)
+2. All requirement IDs (TEST-01, TEST-05, INF-01) have test coverage
+3. Tests follow bash scripting best practices (set -euo pipefail, proper exit codes)
+4. Student can run individual tests or full suite
+5. Final verification script provides clear pass/fail report for all lab requirements
+</success_criteria>
+
+<output>
+After completion, create `.planning/phases/02-lab-01-iam-sicurezza/02-01-SUMMARY.md`
+</output>

.planning/phases/02-lab-01-iam-sicurezza/02-03-PLAN.md

@@ -0,0 +1,504 @@
+---
+phase: 02-lab-01-iam-sicurezza
+plan: 03
+type: execute
+wave: 2
+depends_on: [02-01, 02-02]
+files_modified:
+  - labs/lab-01-iam/Dockerfile
+  - labs/lab-01-iam/docker-compose.yml
+  - labs/lab-01-iam/tests/04-verify-infrastructure.sh
+autonomous: true
+requirements: [LAB-01, INF-01, TEST-01]
+user_setup: []
+must_haves:
+  truths:
+    - "docker-compose.yml defines services with non-root user directive (INF-01)"
+    - "Dockerfile creates non-root user and switches before CMD (INF-01)"
+    - "Test scripts validate non-root execution (INF-01)"
+    - "Infrastructure follows test-driven approach (GREEN phase of TDI)"
+  artifacts:
+    - path: "labs/lab-01-iam/Dockerfile"
+      provides: "Non-root container image definition"
+      min_lines: 15
+    - path: "labs/lab-01-iam/docker-compose.yml"
+      provides: "Service orchestration with user directive"
+      min_lines: 20
+    - path: "labs/lab-01-iam/tests/04-verify-infrastructure.sh"
+      provides: "Infrastructure verification script"
+      min_lines: 25
+  key_links:
+    - from: "docker-compose.yml"
+      to: "Dockerfile"
+      via: "build context and image reference"
+      pattern: "build:.*\\..*Dockerfile"
+    - from: "tests/04-verify-infrastructure.sh"
+      to: "docker-compose.yml, Dockerfile"
+      via: "Infrastructure validation"
+      pattern: "docker-compose.*-f.*docker-compose.yml"
+---
+
+<objective>
+Create Docker infrastructure (Dockerfile and docker-compose.yml) that implements non-root container execution (INF-01). Following TDD methodology, infrastructure is created AFTER tests exist, and tests should now pass (GREEN phase).
+
+Purpose: Implement minimum infrastructure to satisfy LAB-01 and INF-01 requirements while ensuring all containers run as non-root.
+Output: Dockerfile with non-root user, docker-compose.yml with user directive, and infrastructure verification test.
+</objective>
+
+<execution_context>
+@/home/luca/.claude/get-shit-done/workflows/execute-plan.md
+@/home/luca/.claude/get-shit-done/templates/summary.md
+</execution_context>
+
+<context>
+@.planning/PROJECT.md
+@.planning/ROADMAP.md
+@.planning/STATE.md
+@.planning/phases/02-lab-01-iam-sicurezza/02-RESEARCH.md
+@.planning/phases/02-lab-01-iam-sicurezza/02-VALIDATION.md
+@CLAUDE.md
+
+# From RESEARCH.md - Non-Root Container Pattern
+
+```dockerfile
+# Source: Docker security best practices
+FROM alpine:3.19
+
+# Create non-root user with specific UID/GID for consistency
+RUN addgroup -g 1000 appgroup && \
+    adduser -D -u 1000 -G appgroup appuser
+
+# Switch to non-root user BEFORE any operations
+USER appuser
+
+# Verify non-root execution
+CMD ["sh", "-c", "echo 'Running as:' && whoami"]
+```
+
+```yaml
+# docker-compose.yml with user directive
+services:
+  test-container:
+    image: alpine:3.19
+    user: "1000:1000"  # UID:GID for non-root
+    command: ["sh", "-c", "whoami && sleep 3600"]
+```
+
+# From RESEARCH.md - Verification Methods
+
+```bash
+# Method 1: Execute whoami inside container
+docker exec <container_name> whoami
+# Expected output: appuser (NOT root)
+
+# Method 2: Inspect container configuration
+docker inspect <container_name> --format='{{.State.User}}'
+
+# Method 3: Check process on host
+docker top <container_name>
+# Look at USER column - should show UID (e.g., 1000), NOT 0 (root)
+```
+
+# Common Pitfalls to Avoid
+
+- Running containers as root (violates INF-01)
+- Using `--privileged` flag (defeats container isolation)
+- Skipping verification of non-root execution
+- Forgetting `user:` directive in docker-compose.yml
+
+# TDD Methodology - GREEN Phase
+
+Now that tests exist (Wave 0), implement MINIMUM infrastructure to make them pass:
+1. docker-compose.yml with `user:` directive
+2. Dockerfile with `USER` directive
+3. Run tests to verify GREEN phase
+4. Do NOT over-engineer - minimum to pass tests is sufficient
+</context>
+
+<tasks>
+
+<task type="auto" tdd="true">
+  <name>Task 1: Create Dockerfile with non-root user</name>
+  <files>labs/lab-01-iam/Dockerfile</files>
+  <behavior>
+    - Base image: alpine:3.19 (small, secure)
+    - Creates non-root user with UID/GID 1000
+    - Switches to non-root user with USER directive
+    - CMD demonstrates non-root execution with whoami
+    - Follows INF-01 requirement (no root execution)
+  </behavior>
+  <action>
+Create Dockerfile that implements non-root container execution:
+
+```dockerfile
+# Lab 01 - IAM & Sicurezza
+# Dockerfile per container non-root (INF-01 requirement)
+#
+# Questo Dockerfile dimostra come creare un container che gira
+# come utente non-root, seguendo il principio del minimo privilegio.
+
+FROM alpine:3.19
+
+# Label per metadata
+LABEL maintainer="Lab 01 - IAM & Sicurezza"
+LABEL description="Container non-root per dimostrare permessi IAM"
+LABEL version="1.0"
+
+# Crea utente non-root con UID/GID specifici per consistenza
+# UID 1000 e GID 1000 sono comuni per utenti non-root
+RUN addgroup -g 1000 labuser && \
+    adduser -D -u 1000 -G labuser labuser
+
+# Imposta la working directory (creata con adduser -D)
+WORKDIR /home/labuser
+
+# Crea un file semplice per verificare i permessi di scrittura
+RUN echo "Questo file e stato creato durante la build" > /home/labuser/test.txt && \
+    chown labuser:labuser /home/labuser/test.txt
+
+# PASSA A UTENTE NON-ROOT PRIMA DI QUALSIASI OPERAZIONE
+# Questo e il punto chiave per INF-01: nessun processo gira come root
+USER labuser
+
+# Verifica che il container gira come utente non-root
+CMD ["sh", "-c", "\
+echo '========================================' && \
+echo 'Lab 01 - IAM & Sicurezza' && \
+echo 'Container non-root verification (INF-01)' && \
+echo '========================================' && \
+echo '' && \
+echo 'Utente corrente:' && \
+whoami && \
+echo '' && \
+echo 'UID:' && \
+id -u && \
+echo '' && \
+echo 'GID:' && \
+id -g && \
+echo '' && \
+echo 'Gruppi:' && \
+groups && \
+echo '' && \
+echo 'Home directory:' && \
+pwd && \
+echo '' && \
+echo 'Contenuto di test.txt (permessi scrittura):' && \
+cat test.txt && \
+echo '' && \
+echo '========================================' && \
+echo 'Se vedi \"labuser\" sopra, INF-01 e soddisfatto!' && \
+echo '========================================' && \
+echo '' && \
+echo 'Container in esecuzione. Premi Ctrl-C per uscire.' && \
+sleep 3600 \
+"]
+```
+
+Key implementation points:
+- Base image Alpine 3.19 (minimal, secure)
+- Creates `labuser` with UID/GID 1000
+- USER directive switches to non-root BEFORE CMD
+- CMD demonstrates and verifies non-root execution
+- Follows INF-01 requirement strictly
+- Labels for metadata and documentation
+- Working directory set to user's home
+- Test file to verify write permissions
+
+TDD Context: This is the GREEN phase - tests already exist (from Wave 0), this Dockerfile should make those tests pass.
+  </action>
+  <verify>
+    <automated>cd labs/lab-01-iam && docker build -t lab01-non-root . && docker run --rm lab01-non-root | grep -q "labuser" && echo "PASS: Container runs as non-root" || echo "FAIL: Container not running as labuser"</automated>
+  </verify>
+  <done>Dockerfile creates non-root container verified by whoami output</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 2: Create docker-compose.yml with user directive</name>
+  <files>labs/lab-01-iam/docker-compose.yml</files>
+  <behavior>
+    - Defines service with local image build
+    - Specifies user directive (1000:1000) for non-root execution
+    - Includes container_name for easy reference
+    - Follows INF-01 requirement (no root)
+    - Enables test scripts to verify configuration
+  </behavior>
+  <action>
+Create docker-compose.yml that enforces non-root execution:
+
+```yaml
+# Lab 01 - IAM & Sicurezza
+# Docker Compose configuration per container non-root
+#
+# Questo file definisce i servizi per il lab, assicurandosi che
+# TUTTI i container girino come utente non-root (INF-01).
+
+version: "3.8"
+
+services:
+  # Container di test per verificare l'esecuzione non-root
+  lab01-test:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    image: lab01-non-root:latest
+    container_name: lab01-iam-test
+    # CRITICO: user directive assicura esecuzione non-root (INF-01)
+    # Format: UID:GID
+    # 1000:1000 corrisponde all'utente labuser creato nel Dockerfile
+    user: "1000:1000"
+    # Non esponiamo porte (non necessario per questo lab)
+    # Le porte private non devono essere esposte sull'host (best practice)
+    restart: unless-stopped
+    # Nessun volume mount necessario per questo lab semplice
+    # I volumi saranno introdotti nei lab successivi
+    healthcheck:
+      # Healthcheck per verificare che il container sia sano
+      test: ["CMD", "sh", "-c", "whoami | grep -q labuser"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 5s
+
+# Nessuna rete definita - useremo la default bridge network
+# Le reti custom isolate saranno introdotte nel Lab 02 (Network & VPC)
+
+# Nessun volume definito - i volumi saranno introdotti nel Lab 04 (Storage & S3)
+```
+
+Key implementation points:
+- Service definition with local build context
+- `user: "1000:1000"` directive enforces non-root execution
+- Container name matches test expectations
+- Healthcheck verifies non-root user
+- Comments explain why no volumes/networks (future labs)
+- Follows docker-compose V3.8 syntax
+- No ports exposed (security best practice)
+
+TDD Context: Tests from Wave 0 check for user directive - this configuration should satisfy those tests.
+
+INF-01 Compliance:
+- User directive explicitly set
+- Healthcheck verifies non-root execution
+- No possibility of root execution
+  </action>
+  <verify>
+    <automated>cd labs/lab-01-iam && docker-compose config > /dev/null 2>&1 && echo "PASS: docker-compose.yml is valid" || echo "FAIL: docker-compose.yml has errors"</automated>
+  </verify>
+  <done>docker-compose.yml defines service with non-root user directive</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>Task 3: Create infrastructure verification script</name>
+  <files>labs/lab-01-iam/tests/04-verify-infrastructure.sh</files>
+  <behavior>
+    - Test 1: docker-compose.yml is valid YAML
+    - Test 2: Dockerfile builds successfully
+    - Test 3: Service has user directive set
+    - Test 4: Built container runs as non-root
+    - Test 5: All INF-01 requirements satisfied
+  </behavior>
+  <action>
+Create infrastructure verification script (TDD GREEN phase verification):
+
+```bash
+#!/bin/bash
+# Infrastructure Verification: Lab 01
+# Verifies that docker-compose.yml and Dockerfile satisfy all requirements
+# This is the GREEN phase check - tests should pass after infrastructure implementation
+
+set -euo pipefail
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m'
+
+TEST_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$TEST_DIR/../.." && pwd)"
+LAB_DIR="$PROJECT_ROOT/labs/lab-01-iam"
+
+cd "$LAB_DIR"
+
+echo -e "${BLUE}========================================${NC}"
+echo -e "${BLUE}Lab 01 Infrastructure Verification${NC}"
+echo -e "${BLUE}GREEN Phase Check${NC}"
+echo -e "${BLUE}========================================${NC}"
+echo ""
+
+pass_count=0
+fail_count=0
+
+# Test 1: docker-compose.yml is valid
+echo -e "${BLUE}[1/6] Checking docker-compose.yml syntax...${NC}"
+if docker-compose config >/dev/null 2>&1; then
+    echo -e "  ${GREEN}✓${NC} docker-compose.yml is valid YAML"
+    ((pass_count++))
+else
+    echo -e "  ${RED}✗${NC} docker-compose.yml has syntax errors"
+    ((fail_count++))
+fi
+echo ""
+
+# Test 2: Dockerfile exists and is readable
+echo -e "${BLUE}[2/6] Checking Dockerfile...${NC}"
+if [ -f "Dockerfile" ]; then
+    echo -e "  ${GREEN}✓${NC} Dockerfile exists"
+
+    # Check for USER directive
+    if grep -q "^USER" Dockerfile; then
+        user_line=$(grep "^USER" Dockerfile)
+        echo -e "  ${GREEN}✓${NC} USER directive found: $user_line"
+        ((pass_count++))
+    else
+        echo -e "  ${RED}✗${NC} No USER directive found in Dockerfile"
+        ((fail_count++))
+    fi
+else
+    echo -e "  ${RED}✗${NC} Dockerfile not found"
+    ((fail_count++))
+fi
+echo ""
+
+# Test 3: docker-compose.yml has user directive
+echo -e "${BLUE}[3/6] Checking docker-compose.yml user directive...${NC}"
+if grep -q "user:" docker-compose.yml; then
+    user_value=$(grep "user:" docker-compose.yml | head -1 | sed 's/.*user: *//' | tr -d '"')
+    echo -e "  ${GREEN}✓${NC} user directive found: $user_value"
+
+    # Verify it's not root (0:0)
+    if [[ "$user_value" != *"0:0"* ]] && [[ "$user_value" != *"root"* ]]; then
+        echo -e "  ${GREEN}✓${NC} User is not root (INF-01 compliant)"
+        ((pass_count++))
+    else
+        echo -e "  ${RED}✗${NC} User is root (INF-01 violation)"
+        ((fail_count++))
+    fi
+else
+    echo -e "  ${RED}✗${NC} No user directive in docker-compose.yml"
+    ((fail_count++))
+fi
+echo ""
+
+# Test 4: Build Docker image
+echo -e "${BLUE}[4/6] Building Docker image...${NC}"
+if docker build -t lab01-non-root -q Dockerfile >/dev/null 2>&1; then
+    echo -e "  ${GREEN}✓${NC} Docker image built successfully"
+    ((pass_count++))
+else
+    echo -e "  ${RED}✗${NC} Docker image build failed"
+    ((fail_count++))
+fi
+echo ""
+
+# Test 5: Verify container runs as non-root
+echo -e "${BLUE}[5/6] Verifying non-root execution...${NC}"
+if docker run --rm lab01-non-root whoami 2>/dev/null | grep -q "labuser"; then
+    echo -e "  ${GREEN}✓${NC} Container runs as non-root user (labuser)"
+    ((pass_count++))
+else
+    echo -e "  ${RED}✗${NC} Container not running as labuser"
+    ((fail_count++))
+fi
+echo ""
+
+# Test 6: Verify docker-compose service
+echo -e "${BLUE}[6/6] Verifying docker-compose service...${NC}"
+# Start container in detached mode
+if docker-compose up -d >/dev/null 2>&1; then
+    echo -e "  ${GREEN}✓${NC} docker-compose service started"
+
+    # Wait for container to be ready
+    sleep 3
+
+    # Check container is running
+    if docker ps --format "{{.Names}}" | grep -q "^lab01-iam-test$"; then
+        echo -e "  ${GREEN}✓${NC} Container is running"
+
+        # Verify user
+        actual_user=$(docker exec lab01-iam-test whoami 2>/dev/null || echo "unknown")
+        if [ "$actual_user" = "labuser" ]; then
+            echo -e "  ${GREEN}✓${NC} docker-compose container runs as non-root"
+            ((pass_count++))
+        else
+            echo -e "  ${RED}✗${NC} docker-compose container running as $actual_user (expected labuser)"
+            ((fail_count++))
+        fi
+    else
+        echo -e "  ${RED}✗${NC} Container not running"
+        ((fail_count++))
+    fi
+
+    # Cleanup
+    docker-compose down --volumes >/dev/null 2>&1
+else
+    echo -e "  ${RED}✗${NC} Failed to start docker-compose service"
+    ((fail_count++))
+fi
+echo ""
+
+# Summary
+echo -e "${BLUE}========================================${NC}"
+echo -e "${BLUE}Verification Summary${NC}"
+echo -e "${BLUE}========================================${NC}"
+echo "Passed: $pass_count/6"
+echo "Failed: $fail_count/6"
+echo ""
+
+if [ $fail_count -eq 0 ]; then
+    echo -e "${GREEN}All checks passed!${NC}"
+    echo -e "${GREEN}GREEN phase complete - infrastructure satisfies tests${NC}"
+    echo ""
+    echo "Next: Run full test suite"
+    echo "  bash labs/lab-01-iam/tests/run-all-tests.sh"
+    echo -e "${BLUE}========================================${NC}"
+    exit 0
+else
+    echo -e "${RED}Some checks failed${NC}"
+    echo -e "${RED}Infrastructure needs fixes before tests will pass${NC}"
+    echo -e "${BLUE}========================================${NC}"
+    exit 1
+fi
+```
+
+Key implementation points:
+- Validates docker-compose.yml syntax
+- Verifies USER directive in Dockerfile
+- Verifies user directive in docker-compose.yml
+- Builds and tests Docker image
+- Starts container with docker-compose and verifies execution
+- Proper cleanup after testing
+- Clear pass/fail indicators
+
+TDD Context: This script confirms the GREEN phase - infrastructure implementation makes tests pass.
+  </action>
+  <verify>
+    <automated>chmod +x labs/lab-01-iam/tests/04-verify-infrastructure.sh && cd labs/lab-01-iam && bash ../tests/04-verify-infrastructure.sh</automated>
+  </verify>
+  <done>Infrastructure verification script confirms all requirements satisfied</done>
+</task>
+
+</tasks>
+
+<verification>
+1. Dockerfile creates non-root user with USER directive
+2. docker-compose.yml specifies user directive for service
+3. docker-compose config validates without errors
+4. Docker build succeeds without warnings
+5. Container execution verified as non-root (whoami, docker inspect, docker top)
+6. All Wave 0 tests now pass (GREEN phase of TDD)
+7. INF-01 requirement satisfied: no container runs as root
+</verification>
+
+<success_criteria>
+1. Dockerfile follows non-root best practices from RESEARCH.md
+2. docker-compose.yml enforces non-root execution via user directive
+3. Infrastructure verification confirms all requirements met
+4. Tests from Wave 0 (02-01-PLAN.md) now pass
+5. LAB-01 requirement satisfied: students can configure users and Docker permissions
+6. INF-01 requirement satisfied: no container runs as root
+</success_criteria>
+
+<output>
+After completion, create `.planning/phases/02-lab-01-iam-sicurezza/02-03-SUMMARY.md`
+</output>