Practical Security

Security coverage here is scoped to systems a small team actually operates: a rented Linux host, containers, a database, a CI pipeline and a CDN in front. No threat modelling frameworks, no compliance checklists.

The organising principle is verification. A firewall rule you have not tested from outside the host is a belief. A backup you have not restored is a hypothesis. A permission you assume is narrow is worth checking, because the gap between intended and actual configuration is where nearly every self-hosted compromise lives.

The single most under-appreciated issue in this stack is that Docker manipulates iptables directly. Its rules are evaluated before the ones UFW manages, which means a container published with -p 5432:5432 is on the public internet even though the firewall shows a default-deny policy. People discover this from a compromised database, not from a scan.

After that, in rough order of value: key-only SSH with root login disabled; secrets in files with restrictive permissions rather than in images or workflow YAML; application database roles that cannot alter their own schema; and container settings that drop capabilities and block privilege escalation.

The supply chain deserves its own attention. A pipeline runs with production credentials, third-party actions run with access to those credentials, and a mutable version tag can point at new code tomorrow. Pinning to commit hashes and scoping tokens per job costs nothing and removes an entire category of risk.

Every article here includes the command that proves the control works, not just the command that configures it.