Lakshay Walia | DevOps Security & Dockerfile Linter

Insecure Dockerfile

Scanning layers for vulnerabilities...

Grade: D - 6 Vulnerabilities Detected

Critical security and performance antipatterns found.

Critical
Running as root: Container runs as default root user. Use a non-root user.
Critical
Hardcoded Secrets: DATABASE_URL contains plain text credentials in ENV.
Warning
Unpinned Image Tag: `node:latest` can break builds. Pin a specific SHA or version.
Warning
Missing Healthcheck: No HEALTHCHECK instruction defined for orchestration.
Warning
Layer Caching: Multiple RUN apt-get commands without cleaning cache increases image size.

✨ Lakshay's Hardened Version

# 1. Use pinned, alpine image for smaller attack surface
FROM node:18.17.0-alpine3.18 AS builder

WORKDIR /app
COPY package*.json ./
# 2. Clean npm cache
RUN npm ci --only=production && npm cache clean --force

COPY . .

# Multi-stage build
FROM node:18.17.0-alpine3.18

# 3. Create non-root user
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
USER appuser

WORKDIR /app
COPY --from=builder --chown=appuser:appgroup /app /app

# 4. Expose only required app port
EXPOSE 8080

# 5. Add Healthcheck
HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
  CMD wget --no-verbose --tries=1 --spider http://localhost:8080/health || exit 1

# Secrets should be passed via Secrets Manager at runtime, not ENV
CMD ["node", "server.js"]

Insecure Terraform Security Group

Analyzing Terraform plan for misconfigurations...

Grade: F - 3 Critical Vulnerabilities

Severe network exposure detected.

Critical
Public SSH Access: Port 22 is open to 0.0.0.0/0. Limit to VPN/Bastion IP.
Critical
Public Database: PostgreSQL (5432) exposed to the internet. Restrict to internal VPC subnets.
Warning
Unencrypted HTTP: Port 80 is open without HTTPS (443) setup. Recommend ALB redirect.

✨ Lakshay's Hardened Version

resource "aws_security_group" "web_sg" {
  name        = "web-server-sg-hardened"
  description = "Hardened SG for Web Servers"
  vpc_id      = aws_vpc.main.id

  # 1. Allow HTTPS from anywhere
  ingress {
    description = "HTTPS from internet"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  # 2. Restrict SSH to corporate VPN/Bastion IP only
  ingress {
    description = "SSH from Corp VPN"
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["10.200.0.0/16"] # Example VPN CIDR
  }

  # 3. Restrict DB access to application security group only
  ingress {
    description     = "PostgreSQL from App Tier"
    from_port       = 5432
    to_port         = 5432
    protocol        = "tcp"
    security_groups = [aws_security_group.app_tier.id]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}