Review container hardening and AppArmor candidates #9

New issue

Open

opened 2026-08-23 17:07:49 +00:00 by stanta · 0 comments

stanta commented

2026-08-23 17:07:49 +00:00

Owner

Outcome

Apply targeted capability, filesystem, and AppArmor controls only where they improve a measured risk.

Current state

The repository has no complete workload-by-workload hardening review. Broad templates could break stateful or privileged services.

Work

Select representative public, internal, and privileged workloads.
Inventory required capabilities and writable paths.
Test read-only filesystems and capability removal.
Evaluate AppArmor where recovery remains practical.
Record rejected controls and reasons.

Validation

Changed workloads pass live functional tests.
No control is accepted only because Compose starts.
Rollback steps are recorded.

References

iac/guides/roadmap-phase-2.md
iac/ansible/roles/

## Outcome Apply targeted capability, filesystem, and AppArmor controls only where they improve a measured risk. ## Current state The repository has no complete workload-by-workload hardening review. Broad templates could break stateful or privileged services. ## Work - [ ] Select representative public, internal, and privileged workloads. - [ ] Inventory required capabilities and writable paths. - [ ] Test read-only filesystems and capability removal. - [ ] Evaluate AppArmor where recovery remains practical. - [ ] Record rejected controls and reasons. ## Validation - [ ] Changed workloads pass live functional tests. - [ ] No control is accepted only because Compose starts. - [ ] Rollback steps are recorded. ## References - `iac/guides/roadmap-phase-2.md` - `iac/ansible/roles/`

stanta added the

area/security

type/security

priority

labels

2026-08-23 17:07:49 +00:00