Title: Discussion 5 — Before/After: Shrinking the Attack Surface
Course: AIINFRA 303: Capstone Project > Section: Week 05 — Building the Core: Containerized Services and Environments

💬 Discussion 5 — Before/After: Shrinking the Attack Surface (20 pts)

Post your before and after numbers from converting your capstone's core service to a multi-stage build with a non-root user:

- What was your image size before (single-stage, root user, if you built one) and after (multi-stage, non-root)?
- What specifically did the runtime image stop carrying — compilers, source files, package caches, dev dependencies?
- Beyond size, what changed about the attack surface? (e.g., no shell-accessible build tools, no root process, pinned base tag instead of :latest)
- Was anything harder than expected about the multi-stage split — for example, a runtime dependency that turned out to need a build tool you almost forgot to include?

Respond to at least two classmates: compare their size reduction to yours, and suggest one additional hardening step (a missing pinned tag, a capability that could be dropped, a secret you notice is hardcoded) if you spot one in their description.