Hardening
The security cleanup pass: remove unused software and features, close spare ports, drop privileges, and tighten every permissive default.
See it
What it is
Hardening is the subtraction pass after something works: remove unused packages and services, close ports, disable sample accounts and debug routes, drop privileges, restrict file access, and replace permissive defaults. Each deletion shrinks the attack surface and leaves fewer things to patch, monitor, and explain.
Do it when creating a base image, production environment, database, browser policy, or CI runner, then repeat after major upgrades. CIS Benchmarks are useful checklists for common operating systems, cloud services, Kubernetes, and databases, but a benchmark is a starting point. The best setting still depends on what this system genuinely needs to do.
The common failure is a lockdown that nobody can reproduce. A manual firewall tweak disappears with the next machine, and a copied benchmark can break backups or observability without improving the threats that matter. Put the settings in images and infrastructure code, test the required behavior, and record every exception with an owner and reason. Hardening also does not replace patching; a tiny exposed service can still contain a critical bug.
Ask AI for it
Harden this project's production image and deployment using the relevant CIS Docker Benchmark and CIS Distribution Independent Linux Benchmark as checklists. Inventory listening ports, installed packages, background services, users, writable paths, Linux capabilities, debug routes, and public endpoints. Remove everything the application does not need; use a non-root Dockerfile `USER`, a read-only root filesystem, `no-new-privileges`, the default seccomp profile, explicit inbound firewall rules, and least-privilege file permissions. Express each change in the Dockerfile, Terraform, Kubernetes manifest, or startup config, add a smoke test for required behavior, and produce a short exception list for benchmark controls that cannot be enabled.