A simple Python web server for demonstrating container security policies.

• Health Check Endpoint: /health returns JSON status
• Web Interface: / shows security status with visual indicators
• Security Reporting: Shows current user ID and root access status
• Container-Ready: Designed for Kubernetes deployment

• ✅ Non-root user (guardian UID 1000+)
• ✅ Minimal base image (python:3.11-slim)
• ✅ Proper file permissions
• ✅ Health check configuration
• ✅ Security labels

• ❌ Runs as root (UID 0)
• ❌ No user restrictions
• ❌ Demonstrates policy violations

docker build -t guardian-demo:secure .

docker build -f Dockerfile.insecure -t guardian-demo:insecure .

# Secure version
docker run -p 8080:8080 guardian-demo:secure

# Insecure version
docker run -p 8080:8080 guardian-demo:insecure

Then visit:

• http://localhost:8080 - Web interface
• http://localhost:8080/health - Health check JSON

This demo is designed to work with:

• Docker Hub: username/guardian-demo:tag
• GitHub Packages: ghcr.io/username/guardian-demo:tag

This application is used by:

• demos/1-policy-guardrails/ - Kyverno admission control
• demos/2-supply-chain-trust/ - Image signing and SBOM
• demos/3-image-hardening/ - Vulnerability scanning comparisons