azwadhq/isec6000-node-app repository overview

⁠Hardened Node.js Application (DevSecOps Artifact)

⁠Overview

This repository hosts a security-hardened Node.js (Express) web application. It serves as the final compiled artifact of an automated DevSecOps CI/CD pipeline engineered to demonstrate secure software supply chain practices, automated quality gates, and container security hardening.

⁠Security & Architecture Features

• Minimal Attack Surface: Built on a lightweight node:20-alpine base image using a multi-stage Dockerfile. The final production image is highly optimized (~46 MB) and strictly excludes all development tooling and source compilers.
• Principle of Least Privilege: Drops default root access natively. All runtime processes execute under the unprivileged node user identifier, mitigating container breakout risks.
• Verified Artifact: This image is only pushed to the registry after passing automated Jest unit testing and strict dynamic dependency vulnerability scanning (npm audit --audit-level=high) within the CI/CD pipeline.

⁠How to Run

You can pull and execute the latest verified container image using the following command:

docker run -d -p 3000:3000 --name secure-node-app azwadhq/isec6000-node-app:latest

Note: The application listens on port 3000 inside the container. You can adjust the host port mapping (-p <host-port>:3000) based on your environment requirements.

⁠Source Code & Pipeline Infrastructure

The Infrastructure-as-Code (IaC), test suites, and declarative Jenkins pipeline responsible for compiling and verifying this image are publicly available for review:

• Application & Pipeline Repository: https://github.com/AzwadBhuiyan/aws-elastic-beanstalk-express-js-sample⁠
• Runner Infrastructure Repository: https://github.com/AzwadBhuiyan/ISEC6000-Jenkins-Docker⁠