DevSecOps Docker Audit

Overview

DevSecOps assignment hardening an existing Node.js app's Docker and CI configuration. Implemented non-root execution, alpine image reduction, and GitHub Actions Trivy vulnerability scanning.

Links & Evidence

Security Hardening Steps

• Base Image Pinning: Migrated from unpinned Debian to Alpine Node images.
• Least Privilege: Created a dedicated non-root system account and sandboxed execution.
• Shift-Left Security: Embedded Aqua Security Trivy into the GitHub Actions pipeline for vulnerability scanning.
• Supply Chain Defense: SHA-pinned all GitHub Actions against tag-mutability attacks.