OS Hardening as Code

A 6-episode series on declarative OS hardening — from why default cloud AMIs are insecure by design to running an automated compliance gate in your CI/CD pipeline.

Who it’s for: Linux administrators, DevOps engineers, and platform teams who build or maintain cloud infrastructure and need every deployed instance to be hardened, verified, and auditable by default.

# Declare your baseline — one file per provider
vim blueprints/ubuntu/22.04/cis-l1-aws.yaml   # HardeningBlueprint

# Check it offline, before spending anything
bakex validate blueprints/ubuntu/22.04/cis-l1-aws.yaml

# Build it — provider comes from the blueprint, not a flag
bakex build blueprints/ubuntu/22.04/cis-l1-aws.yaml

# Gate on it in CI/CD
POST /api/pipeline/scan            # returns a `passed` boolean + SARIF

Built with BakeX — released as Stratum and renamed at v0.6.0.
github.com/invicton/bakex

By EP05, hardened images are a pipeline constraint — an unhardened image cannot reach production.

Published Episodes

EP	Title
EP01	Cloud AMI Security Risks: Why Custom OS Images Are Non-Negotiable
EP02	Linux Hardening as Code: Declare Your OS Baseline in YAML
EP03	One Blueprint, Six Clouds — Multi-Provider OS Image Builds
EP04	Compliance Grading — Automated OpenSCAP with A-F Scores Before Deployment
EP05	The Pipeline Gate — Hardened Images as a CI/CD Build Constraint
EP06	BakeX — OS Hardening as a Platform

Series complete — all 6 episodes published.

Start with EP01: Cloud AMI Security Risks →

Get new episodes in your inbox → subscribe