Complete procedures with a way back.

Build a one-job Linux runner with restricted repository access, an unprivileged account, verified release, minimal network, external logs, immutable updates, fork isolation, and complete post-job destruction.

Deploy scoped response headers and modern TLS settings, validate application compatibility, prevent duplicate headers, and retain a fast rollback.

Install from Docker's signed repository, limit daemon exposure, bound logs, and document privilege boundaries.

Remove anonymous and test access, restrict administration, enforce TLS where remote clients are required, audit grants, and verify exposure.

Create a default-deny host firewall with loopback, established traffic, controlled SSH, service ports, logging, validation, and rollback.

Introduce per-user keys, validate a drop-in, test a second session, and only then disable password and root login.

Measure the current unit, add compatible filesystem and privilege restrictions, validate application paths, and roll out hardening without breaking package upgrades.

Separate CLI and FPM settings, hide unsafe disclosure, bound resources, secure sessions, centralize errors, and verify effective values through the web SAPI.

Use a dedicated identity, explicit paths, bounded restarts, sandboxing, logs, and a verified rollback.

Create a named administrator, prove key-based recovery access, patch the host, restrict SSH, enable a host firewall, and verify time and exposed services.