JefeLinux implements a defense-in-depth security model across six layers,
from kernel hardening to application-level confinement. Every component
was chosen for minimal attack surface and maximum auditability.
Layer 1
Kernel Hardening
ASLR, SMAP/SMEP, lockdown mode, pointer restriction, dmesg restriction
Layer 2
Mandatory Access Control
AppArmor profiles confining dockerd, containerd, sshd, python3, node
Layer 3
Network Perimeter
nftables default-DROP policy, SSH rate limiting at 3 connections/minute
Layer 4
Authentication
Key-only SSH, root login disabled, fail2ban brute-force protection
Layer 5
Audit & Monitoring
auditd syscall tracking, file integrity monitoring on /etc/shadow, /etc/passwd
Layer 6
Container Isolation
Docker 24 with AppArmor-confined containerd, no privileged containers
Build Pipeline
5-Stage Build
Bootstrap → Packages → Security → Overlay → ISO (5-8 minutes)
Base System
Alpine + musl
5 MB base image, 900 KB libc, 400+ BusyBox utilities in a single binary