The hardening travels with the copy

The security team spent two weeks on one container: firewall egress rules that allow the package mirror and the internal Git host and nothing else, a network exit through the corporate proxy, the tooling installed and pinned. They call it golden. They snapshot it.

Every new engineering environment is POST /api/v1/containers/{golden_id}/copy with copy_firewall_rules: true and copy_network_rules: true. The copy gets its own ID, its own URLs, its own SSH key, and the exact egress rules and exit path that golden has. The firewall is enforced on the host, so the new owner can't relax it from inside. Three hundred copies, one baseline, no drift.

When the baseline changes, the team updates golden, re-snapshots, and new copies inherit the change. The old way was a hardening checklist and a hope that each engineer followed it.

The baseline is a container, and every environment is a copy of it.