Lion Cipher Lab
Bake hardening into a reproducible image with Packer (immutable infrastructure)
- Cyber / Security Engineer
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Most servers rot. Someone SSHes in, patches a thing by hand, installs a tool 'just this once,' and six months later no two machines are alike — that's config drift, and it's how a fleet becomes a pile of fragile 'snowflake' servers nobody can safely rebuild. Worse for security: an attacker who lands on a long-lived box can quietly persist for months. Golden images flip that. You bake hardening into ONE image, deploy identical copies, and when something's wrong you throw the box away and stamp out a fresh one — no accumulated cruft, no lingering attacker. Treating servers as disposable…
What you'll learn
- Immutable infrastructure
- Golden images
- HashiCorp Packer
- Packer HCL2 templates
- Infrastructure as Code
- Baking hardening into an image
Steps in this lab
- Pets vs. cattle: what a golden image actually is
- Why rebuild-and-replace beats patch-in-place (the judgment)
- Make sure Docker is running, then install Packer
- Write the Packer template (HCL2)
- Write the hardening provisioner script
- Init, format, validate, then build
- Prove the hardening is baked into the image
- Do it better — and where this really goes