The Essential Self-Hosted Infrastructure Security Checklist

As networks expand and remote work becomes the norm, securing your self-hosted infrastructure is more critical than ever. We’ve seen a surge in cloud-native workloads being managed through agentic infrastructure, which means the attack surface has expanded. It’s no longer just about firewalls; it’s about protecting the very core of how your autonomous systems operate. To help you navigate this complex landscape and harden your deployments against modern threats, here is a comprehensive checklist of security practices you must implement.

Checklist

• Container Image Scanning – Start by scanning all Docker images for known vulnerabilities before deployment. Tools like Trivy or Clair can integrate directly into your CI/CD pipeline, catching out-of-date packages or misconfigurations early. Never run images pulled directly from public registries without verifying them first. This simple step prevents a huge percentage of easily avoidable breaches.
• Implement Least Privilege – Ensure every container, service, and user operates with the minimum permissions necessary. Avoid running containers as the root user. Utilize Docker’s user namespace remapping to map the container root user to a non-privileged user on the host. This drastically limits the blast radius if a container is compromised, protecting the underlying system.
• Network Segmentation – Don’t let all your services talk to each other by default. Use Docker networks to segment your stack. For example, your database should only be accessible by the backend application, not exposed to the internet or other unrelated containers. Proper segmentation stops lateral movement in its tracks, turning a single compromised service into an isolated incident.
• Secrets Management – Hardcoding passwords or API keys in configuration files or Dockerfiles is a recipe for disaster. Use a dedicated secrets management tool like HashiCorp Vault, Doppler, or even Docker Secrets. These tools securely inject credentials at runtime, ensuring sensitive data isn’t exposed in source control or scattered across your environment variables.
• Regular Auditing and Logging – You can’t secure what you can’t see. Centralize your logs using a stack like ELK or Grafana Loki. More importantly, actively monitor these logs for anomalous behavior. Automated alerts for repeated failed login attempts or unusual network traffic patterns are your first line of defense against active exploitation and infrastructure drift.
• Keep Host Systems Updated – A secure container is useless if the host OS is vulnerable. Establish an automated patch management routine for your underlying Linux servers. Delaying kernel or security updates leaves the foundation of your self-hosted environment weak. Consistency in patching is just as crucial as securing the applications themselves.
• Enable Immutable Deployments – Treat your infrastructure as disposable. Instead of patching a running container or server, deploy a new, updated version and destroy the old one. Immutable deployments prevent configuration drift and ensure you always know exactly what is running in production, making it significantly harder for an attacker to maintain persistence.
• Harden SSH Access – If you must use SSH, disable password authentication entirely and rely solely on public key cryptography. Change the default port to reduce noise from automated scanners. Furthermore, consider implementing a modern zero-trust solution like Tailscale or Cloudflare Tunnel to access your internal services without exposing SSH to the public internet at all.
• Enforce Rate Limiting and WAF – Protect your exposed endpoints from brute-force attacks and common web vulnerabilities. Deploy a Web Application Firewall (WAF) and enforce strict rate limiting on all incoming traffic. This mitigates automated attacks and helps protect against denial-of-service attempts, keeping your services available for legitimate users.
• Implement Robust Backups – Assume you will be compromised. When that happens, your ability to recover dictates the severity of the incident. Implement automated, encrypted backups that are stored off-site and out of reach of your primary infrastructure (the 3-2-1 rule). Regularly test your restoration process to ensure your backups are actually viable when you need them most.

Security is not a one-time configuration but an ongoing process of vigilance. By systematically applying this checklist, you build a resilient foundation for your self-hosted services. Remember, the goal isn’t just to stop attacks, but to make compromising your infrastructure so expensive and difficult that adversaries move on to easier targets. Stay proactive, keep updating, and never assume your perimeter is impenetrable.