Network, OS & Container Security
Segmentation, firewall rules, egress control, process isolation, privilege separation, sandboxing — and why a container is not a security boundary you can lean on.
Every lesson below identifies the asset, attacker capability and boundary before naming the vulnerability. Controls are split into prevention, detection and recovery; residual risk is explicit.
Network design controls reachability and blast radius; it does not turn an internal caller into a trusted identity.
Internet → public layer → application network → database network → management network: crossings are explicit and narrow.
A rule is source, destination, port, protocol and action; every broad wildcard is an explicit expansion of attack surface.
Security also asks what a compromised service can call outward; unrestricted egress enables SSRF, command-and-control and exfiltration.
Processes, users, file permissions, privileges, patching and resource limits decide what a compromised application can do next.
A web server should run as a restricted user; administrative setup and runtime request handling should not share one authority.
Owner, group and others each receive read, write and execute; the effective service identity determines which boundary actually exists.
A sandbox constrains files, network, CPU, memory, syscalls and credentials so untrusted computation cannot spend or reach everything.
Containers package and isolate processes but share a host kernel; privileged mode, host mounts and broad capabilities erase much of the boundary.