Security Hardening

Security Hardening

Secure configurations for running fedramp-docs-mcp in production.

Docker Security

Complete Hardened Setup

docker run -it \
  --user 1000:1000 \
  --read-only \
  --tmpfs /tmp:rw,noexec,nosuid \
  --memory=512m \
  --cpus=1.0 \
  --pids-limit=100 \
  --cap-drop=ALL \
  --security-opt=no-new-privileges:true \
  -v fedramp-cache:/home/fedramp/.cache/fedramp-docs:rw \
  ghcr.io/ethanolivertroy/fedramp-docs-mcp:latest

Security Features

Feature	Flag	Purpose
Non-root user	--user 1000:1000	Run as unprivileged user
Read-only filesystem	--read-only	Prevent modifications
Resource limits	--memory, --cpus	Prevent exhaustion
Drop capabilities	--cap-drop=ALL	Remove Linux capabilities
No privilege escalation	--security-opt=no-new-privileges	Prevent sudo/setuid

Docker Compose (Hardened)

version: '3.8'
services:
  fedramp-docs-mcp:
    image: ghcr.io/ethanolivertroy/fedramp-docs-mcp:latest
    user: "1000:1000"
    read_only: true
    stdin_open: true
    tty: true
    tmpfs:
      - /tmp:rw,noexec,nosuid
    volumes:
      - fedramp-cache:/home/fedramp/.cache/fedramp-docs:rw
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: '1.0'
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
volumes:
  fedramp-cache:

Air-Gapped Operation

For environments without internet:

1. Pre-Clone (on connected system)

git clone https://github.com/FedRAMP/docs.git fedramp-docs
tar -czf fedramp-docs.tar.gz fedramp-docs

2. Transfer & Configure

tar -xzf fedramp-docs.tar.gz -C /opt/
docker run -it \
  --network=none \
  -v /opt/fedramp-docs:/fedramp-docs:ro \
  -e FEDRAMP_DOCS_PATH=/fedramp-docs \
  -e FEDRAMP_DOCS_AUTO_UPDATE=false \
  fedramp-docs-mcp

Network Isolation

After initial clone, disable network:

docker run -it --network=none \
  -v fedramp-cache:/root/.cache/fedramp-docs \
  fedramp-docs-mcp

File Permissions

mkdir -p ~/.cache/fedramp-docs
chmod 700 ~/.cache/fedramp-docs

Audit Logging

DEBUG=fedramp:* npx fedramp-docs-mcp 2>&1 | tee /var/log/fedramp-mcp.log

See Full Security Guide for more details.