Minimal Attack Surface

Build lean, run clean

A smaller attack surface means fewer entry points, less complexity, and better odds during incident response. You don’t need exotic tech - just disciplined engineering at each stage:

Build stage

• Use slim base images or distroless containers; remove shells and package managers from final images.
• Pin dependencies and verify checksums; automate SCA to catch known CVEs early.
• Split dev tools from runtime; multi-stage builds keep final artifacts minimal.

Deploy stage

• Expose only required ports; drop capabilities; run as non-root.
• Read-only filesystems where possible; dedicated service accounts.
• Network policies to isolate workloads; egress controls for data hygiene.

Operate stage

• Hardened configs, least-privilege IAM, short-lived credentials.
• Proactive patching; immutable infra patterns reduce drift.
• Observability with sane alerts; drill incident runbooks.

Key takeaways

• Favor simplicity. Complexity is a liability under pressure.
• Bake in controls at build time - runtime should be boring.
• Iterate: measure exposure and keep shaving it down.