Advanced
Lock down the exposed containers
The penetration test is back: through a flaw in a dependency, the testers wrote a file into the running API container, and they point out that both internet-facing containers keep Docker's default capabilities. Harden frontend and api: a read-only root filesystem, every capability dropped, and no way to gain new privileges. The shop must stay online.
nginx serves the site and forwards /api/ to the API; the API renders invoices in a scratch folder under /tmp. Capabilities a container really needs may be added back one by one, but only after dropping all of them. The test runs docker compose up -d --build, checks frontend and api, and opens http://<server>/api/products every minute for an hour.
What your server must hold
- security.writableRootfs = 0
- security.defaultCapabilities = 0
- security.newPrivileges = 0
- Availability ≥ 99 %