Skip to content

IronClaw blog

Long-form writing on running autonomous AI agents safely. Every post links its claims to shipped code, a versioned threat model, or a benchmark you can re-run yourself. No adjectives standing in for numbers.

Posts

Hardening guides

Per-image, data-driven walkthroughs: the default isolation grade, the exact dimensions that fail, and the precise ironctl scan --fix flags that close the gap, with before and after scores.

  • How to harden a Postgres container - postgres:17-alpine scores 48 of 100 (D) on defaults: root, full capabilities, writable rootfs. Four flags take it to 100 of 100 (A). Is it safe for untrusted workloads?
  • How to harden a Redis container - redis:7-alpine scores 48 of 100 (D). A read-only rootfs and dropped capabilities take the classic CONFIG SET dir file-write RCE off the table before auth. To 100 of 100 (A).
  • How to run untrusted Node.js code safely - the container is the sandbox, not the vm module. node:22-alpine is 48 of 100 (D) by default; network=none plus five flags make it a 100 of 100 (A) boundary for untrusted JS.
  • How to harden an nginx container - nginx:1.27-alpine scores 48 of 100 (D). The honest hardened ceiling for an internet-facing proxy is 89 of 100 (B), because it must reach its upstreams. Here is exactly why.
  • How to harden a MySQL container - mysql:8.4 scores 48 of 100 (D) on defaults: root, full capabilities, writable rootfs. Four flags take it to 100 of 100 (A). Is it safe for untrusted workloads?
  • How to harden an Elasticsearch container - elasticsearch:8.16.1 already runs non-root, so it starts at 63 of 100 (C). Three flags take a single-node index to 100 of 100 (A); a multi-node cluster has an honest 89 of 100 (B) ceiling.
  • How to harden a RabbitMQ container - rabbitmq:4-alpine scores 48 of 100 (D). The honest hardened ceiling for a broker is 89 of 100 (B), because clients must be able to connect to it. Here is exactly why.
  • How to harden a Memcached container - memcached:1.6-alpine runs non-root and holds nothing on disk, so it starts at 63 of 100 (C). A read-only rootfs (no volume needed) and dropped capabilities take it to its honest 89 of 100 (B).
  • How to harden a Cassandra container - cassandra:5.0 scores 48 of 100 (D) on defaults: root, full capabilities, writable rootfs. Four flags take a single-node ring to 100 of 100 (A); a gossiping cluster has an honest 89 of 100 (B) ceiling.
  • How to harden a ClickHouse container - clickhouse:24.8 scores 48 of 100 (D). Cutting egress closes its remote-table reach; four flags take the analytics store to 100 of 100 (A).
  • How to harden a Consul container - hashicorp/consul:1.20 scores 48 of 100 (D). The honest hardened ceiling for a service-mesh agent is 89 of 100 (B), because peers and clients must connect. Unlike Vault, it does not mlock by default.
  • How to harden a MinIO container - minio/minio scores 48 of 100 (D). The honest hardened ceiling for an object store is 89 of 100 (B), because S3 clients must reach the API. Here is exactly why.
  • How to harden a Grafana container - grafana/grafana:11.2.0 already runs non-root, so it starts at 63 of 100 (C). The honest hardened ceiling for a dashboard server is 89 of 100 (B), because browsers must reach the UI.
  • How to harden a Prometheus container - prom/prometheus:v3.1.0 runs as nobody, so it starts at 63 of 100 (C). The honest hardened ceiling for a metrics server is 89 of 100 (B), because it must scrape targets and serve its API.
  • How to harden a Traefik container - traefik:v3.2 scores 48 of 100 (D). The honest hardened ceiling for an edge reverse proxy is 89 of 100 (B), because it exists to accept and forward traffic. Here is exactly why.
  • How to harden an InfluxDB container - influxdb:2.7 scores 48 of 100 (D). Four flags take a co-located time-series store to 100 of 100 (A); a fleet pushing metrics over the network has an honest 89 of 100 (B) ceiling.
  • How to scan a Dockerfile for security issues - a deliberately bad Dockerfile (root default, unpinned base, a baked-in secret) scores 5 of 100 (F) on a static, daemon-free scan. The exact one-line fixes take it to 100 of 100 (A).

Comparisons

Head-to-head reads, each backed by the same scan data, for the questions people actually search.