Decommission the bastion

Somewhere in your infrastructure is a hardened little server whose entire job is being the door. You patch it, rotate its keys, monitor it, and worry about it, because everything else is reachable only through it.

On Hoody, the door is the proxy on the server you already rent. Humans open terminal URLs in a browser. Tools that want real SSH connect to the container's hostname: no sshd runs inside the container; SSH terminates on the host, and the proxy routes each connection by the public key in the handshake. One key maps to exactly one container, and the API refuses to assign a key twice.

There is nothing left to patch, because the door stopped being a server.