Every production container is born locked

The SOC 2 finding says: production access must be explicit and reviewable. Your fleet has 120 containers and a new one every week.

You set it once, at the project: default deny. A devops group by office CIDR gets terminal and files. A monitoring group by bearer token gets HTTP and nothing else. Every container created in the project inherits the posture. A new container inherits the lockdown before anyone types a URL into it.

Need an exception? One container overrides the project for its public-api group: HTTP only, port 8080, from anywhere. The override is a document on that container, readable by the auditor.

There are no per-host sshd configs to drift, no security groups to forget. Access policy is one file at the project level, and every computer under it is born obeying it.

Access policy is one file at the project level, and every computer under it is born obeying it.