Root by default: hardening container privilege on a self-hosted AI stack
- 1Lock down Docker networks
- 2Run containers as non-root
- 🏆Identity in front of every port
Part 1 of this series audited a live
multi-agent box and found every network-exposure question worth asking. One line from
that audit didn't get followed up: "the Postgres, ClickHouse and Redis behind Langfuse
were published to 127.0.0.1 instead of the world — someone made a good decision
there. Hold that thought."
Here's the other half of that thought: getting the network right says nothing about what happens after someone's already inside a container. If the process running in there is root, a compromise starts with the keys to the whole filesystem. So we checked — on the same box, the same Langfuse stack Part 1 already praised — whether "network correct" also meant "privilege correct." It didn't, for two of the six containers. Here's what fixing that actually looked like, including the part that broke.