Guides
Keelix security guides
Practical, opinionated guides for teams running Docker on self-hosted servers. Each guide covers a real attack surface — firewall gaps, container hardening, CI gate design, pre-deploy checklists — and ends with the Keelix scan that verifies the whole thing automatically.
If you're new here, start with is my Docker container exposed to the internet? — the most common gap that surprises self-hosters.
All guides
- Is my Docker container exposed to the internet? →The -p flag bypasses UFW, binds to 0.0.0.0, and punches through your firewall — silently. Learn how Docker's iptables rules work and how to check what's actually reachable.
- How to secure a self-hosted server →A practical VPS hardening checklist: SSH keys, UFW, Fail2ban, auto-updates, Docker socket exposure, and AI/MCP config. Keelix verifies all of it in one scan.
- How to harden Docker →Drop capabilities, block privileged mode, apply seccomp and AppArmor profiles, set resource limits, and keep the host patched. The deterministic checklist Keelix runs automatically.
- How to fail a CI build on security findings →Configure a real security gate — not just a monitoring step — using severity thresholds, exit codes, and Keelix's blended posture score as the merge block.
- Docker deployment security checklist →The pre-deploy checklist for Docker Compose deployments: image hygiene, network isolation, secrets management, host hardening, and compliance evidence — all automatable with Keelix.
Related
Verify the whole checklist in one scan.
Keelix runs every check in these guides automatically — host, containers, exposure, and AI/MCP posture — in under a minute.
operator@host — keelix
# install — free & open source (Apache-2.0)
$ curl -fsSL https://keelix.dev/install.sh | sh
$ keelix scan