# Cybersecurity Hardening Report ## PHASE 1: VULNERABILITY & EXPLOIT SURFACE AUDIT - Flaw 1: Root user execution. The container is running with default root privileges, allowing potential container escape vulnerabilities to compromise the host kernel. - Flaw 2: Build-time secrets leakage. Hardcoded API keys are embedded directly inside the layer history of the Dockerfile image. ## PHASE 2: HARDENING & REMEDIATION BLUEPRINT - Remediation: Implement multi-stage builds and enforce a non-privileged user account before the entrypoint block. - Corrected Setup: Use alpine-based distroless configurations, strip unnecessary system binaries, and pull configurations via runtime environment mounts. ## PHASE 3: PIPELINE INTEGRATION & DEVSECOPS SHIFT-LEFT - Automation Gates: Integrate Trivy into the Gitlab CI pipeline to scan built images during the pre-push stage. - Thresholds: Block the pipeline execution if any Critical or High vulnerability is found within system libraries. ## PHASE 4: RUNTIME GUARDRAILS & MONITORING - Risk 1: Runtime privilege escalation attempts. Mitigation: Enable read-only root filesystems using Docker container flags. - Risk 2: Malicious binary execution. Mitigation: Use runtime profiling tools to detect unexpected system call behavior.