Classification: Ingress Hardening & Attack Surface Reduction
Status: Implemented & Verified

Executive Summary

This report documents the architectural lifecycle of container management on Bastion: from initially deploying a web-based GUI (Portainer) to overcome early CLI friction, to identifying the inherent security risks of host-socket mounting, and finally decommissioning the interface in favor of key-authenticated, terminal-native tooling (lazydocker).

Phase 1: Initial Deployment & Context

Why Portainer Was Introduced

When initially transitioning to Docker and container orchestration, early CLI management presented significant friction. Debugging multi-container networks, diagnosing container start failures, and managing persistent volume paths purely through raw shell commands often led to silent errors and operational overhead.

Classification: Filesystem Security & Runtime Sandboxing Status: Implemented & Verified

Executive Summary

This report analyzes permission boundaries, filesystem isolation, and execution failures encountered when integrating sandboxed application formats (Flatpak and AppImage) with external storage vaults (such as /mnt/lacie). It details the diagnostic triage of permission denials, FUSE execution restrictions, and the decision to standardize core system tooling on native package management.

Threat Model & Problem Statement

Application isolation frameworks (Flatpak, AppImage) provide sandboxing by restricting default access to the host filesystem. However, when operational workflows require direct access to designated storage mounts, isolated runtimes introduce specific operational failure modes:

Classification: Kernel Architecture & Display Subsystem Recovery Status: Implemented & Verified

Executive Summary

This report covers root-cause diagnosis, driver stack reinstallation, and display provider synchronization on a hybrid graphics architecture (Intel Core i9-13900HX / NVIDIA RTX 4090 Mobile) running under non-systemd (Artix) Linux with XFCE Desktop Environment. It details the recovery protocol following a desktop environment collapse (corrupted font/theme subsystems and session manager crashes) and the resolution of xrandr discrete output provider drops.