# Container Hardening

The node-agent applies baseline Docker hardening:

- `cap_drop: ALL` with minimal adds
- `security_opt: no-new-privileges`
- PID limits and log rotation

## Roadmap (Post-MVP)

- **Seccomp** — Custom profile per software family under `deploy/seccomp/`
- **AppArmor** — Node-level profiles for game server containers

See `apps/node-agent/internal/docker/client.go` for current defaults.