Security

What NebulaImage provides

The NebulaImage Docker AMI is built with the following security measures applied at build time:

• No hardcoded credentials — no passwords, API keys, or tokens are embedded in the image
• No pre-embedded SSH keys — access is via the EC2 key pair you specify at launch
• OS security updates — all available patches applied before publication
• UFW firewall — enabled with only SSH (port 22) open by default
• fail2ban — configured to block repeated SSH authentication failures
• Docker daemon — bound to Unix socket only, not exposed on TCP

Your responsibilities after launch

NebulaImage handles image-level security. Once you launch an instance, the following is your responsibility:

Security groups

Restrict inbound traffic to only the ports your application requires. For example, if you're running a web server:

Port 22   — SSH, restricted to your IP or VPN CIDR only
Port 80   — HTTP (if needed)
Port 443  — HTTPS (if needed)

Never open port 22 to 0.0.0.0/0 in production.

SSH hardening

After launch, consider these additional steps:

# Disable password authentication (key-based only is the default)
sudo grep PasswordAuthentication /etc/ssh/sshd_config

# Disable root login
sudo grep PermitRootLogin /etc/ssh/sshd_config

Container security

• Do not run containers as root unless required
• Use --read-only and --no-new-privileges where possible
• Pin image versions in production — do not use :latest tags
• Regularly pull updated base images and rebuild your containers

Secrets management

• Use AWS Secrets Manager or Parameter Store for database credentials, API keys, and tokens
• Do not store secrets in environment variables that are logged or visible in docker inspect
• Use Docker secrets for Swarm-based deployments

Reporting a security issue

Contact [email protected] to report any security concern with a NebulaImage product.