15 lines
414 B
Markdown
15 lines
414 B
Markdown
# Container Hardening
|
|
|
|
The node-agent applies baseline Docker hardening:
|
|
|
|
- `cap_drop: ALL` with minimal adds
|
|
- `security_opt: no-new-privileges`
|
|
- PID limits and log rotation
|
|
|
|
## Roadmap (Post-MVP)
|
|
|
|
- **Seccomp** — Custom profile per software family under `deploy/seccomp/`
|
|
- **AppArmor** — Node-level profiles for game server containers
|
|
|
|
See `apps/node-agent/internal/docker/client.go` for current defaults.
|