Platform Processes & Security Controls

Game Warden is a Department of War (DOW)-authorized DevSecOps platform designed to securely and efficiently deploy SaaS applications into government networks. The platform integrates security tooling, continuous integration/continuous deployment (CI/CD) pipelines, and governance processes to streamline software delivery while ensuring compliance with federal requirements.

Integrated tooling and CI/CD pipelines

Game Warden provides a managed CI/CD ecosystem powered by GitLab, which supports source code management, issue tracking, and pipeline automation. Pipelines enable automated code testing, container image scanning, hardening, and deployment to secured environments.

Image scanning and security tools

Grype, Syft, Trivy, and Tenable: Used for container image security scanning, vulnerability identification, and compliance enforcement.
ClamAV: Performs malware detection on container images.

Image scan results—including Common Vulnerabilities and Exposures (CVEs)—are visible in Findings within the Game Warden web app, providing transparency into your security posture.

Image management with Harbor Registry

Harbor is the secure container registry used by Game Warden. It applies status tags to all container images pushed into Game Warden to identify their scanning and hardening states.

Use tags to track images as they progress through security checks and readiness for deployment.

Understanding images and containers

A container is a lightweight, portable package that contains an application along with all its required dependencies, ensuring consistent execution across different environments.

A container image is a static specification of this package, composed of several layers. The foundational layer is the base image, which provides core operating system components. Other layers include required software packages, such as application binaries, runtime environments (for example, nginx), or other dependencies.

Important

Base images must remain unmodified after selection. Any customization must occur in layers built on top of the base image.

Game Warden supports applications structured with several containers, each hosting a distinct service or function within the application architecture.

Game Warden pipelines and deployment processes

Pipelines are sets of automated tasks that move your applications through scanning, hardening, and deployment stages. Game Warden engineers provision infrastructure, configure pipelines, and develop bootstrap scripts to automate CI/CD workflows.

You can track pipeline progress and security reviews via Findings.

How pipelines support Authorization Package creation

The Game Warden pipelines do more than move your application through CI/CD stages — they also generate critical artifacts that make up your Authorization Package.

As your container images progress through scanning, hardening, and security validation, the results and evidence gathered become part of the documentation package submitted for security approval.

These automated security checks, along with your application architecture and compliance data, are compiled by the Game Warden Security team to build a complete Authorization Package — a required component for deployment into IL4+ environments.

Security hardening and binary reduction

Before deployment, all images are automatically hardened to reduce your application's attack surface. Hardening includes:

Removing unnecessary users and groups and restricting permissions.
Locking down file system permissions on system binaries and sensitive directories.
Cleaning up temporary files and broken symlinks.

How it works

Once you push an image to Harbor, the following happens automatically:

A built-in pipeline triggers and applies hardening to your image.
Game Warden's security tooling scans the hardened image for CVEs.
Scan results appear on the Findings page in the Game Warden web app.

The pipeline tags hardened images with a -hardened suffix and uses them for all Staging and Production deployments. Note that the Findings page displays the original image tag, not the -hardened variant.

Can I harden my images before pushing to Harbor?

You can harden your images before pushing to Harbor to minimize vulnerabilities in your application. Once hardening is complete, run the container on your local machine to verify your application still functions as expected. At minimum, confirm that the application starts successfully, write paths (e.g., /logs, /tmp) are accessible, and expected processes run without errors.

The following platforms are supported by the hardening script:

Value	Runtime
`dotnet`	.NET
`go`	Go
`jdk`	Java (JDK)
`nginx`	NGINX
`nodejs`	Node.js
`python`	Python
`tomcat`	Apache Tomcat

Hardening script example

  #!/bin/sh
  set -e

  user_id=$1

  /tmp/busybox echo "Setting directory permissions for user $user_id"

  # System directories to harden
  all_sysdirs="
    /bin
    /etc
    /lib
    /lib64
    /sbin
    /usr
  "

  # Filter to only existing directories
  sysdirs=""
  for dir in $all_sysdirs; do
    if [ -d "$dir" ]; then
      sysdirs="$sysdirs $dir"
    else
      /tmp/busybox echo "Directory $dir not found. Skipping."
    fi
  done

  # Ensure system dirs are not writable by others
  /tmp/busybox find $sysdirs -xdev -type d \
    -exec /tmp/busybox chmod 0755 {} \;

  # Clean up
  /tmp/busybox rm -f /tmp/busybox

  echo "Directory hardening complete"

Use the following as a reference for applying the hardening script in your Docker build process. Replace <platform> with the appropriate value from the supported platforms table above.

Example Dockerfile for hardening

dockerfile

  FROM registry.gamewarden.io/yourcompany/yourimage:1.0.0
  USER 0
  COPY hardening-scripts/hardening-script.sh /tmp/hardening-script.sh
  RUN chmod +x /tmp/hardening-script.sh \
      && /tmp/hardening-script.sh 65532
  USER 65532

Platform security validation

Game Warden tests platform security through:

Continuous security reviews by the government.
Regular third-party penetration testing.
Managed enforcement of security controls across infrastructure, Kubernetes platforms, and applications.

FAQs

Does an image go through the full pipeline on every run?

No. After the first full pipeline run, subsequent runs are significantly faster. Game Warden will compare vulnerabilities against previously approved justifications and only prompt for justification of any new findings.

What does the Game Warden custom hardening process include?

The hardening process varies depending on what your container includes (e.g., databases). Generally, it involves:

Creating a non-root user with only necessary permissions.
Removing unused user accounts and login shells.
Locking down system directories and file permissions.
Deleting unused files, binaries, kernel tunables, crontabs, and broken symlinks.
Whitelisting only essential executables needed for your container to function.

We will work with your team to confirm that the hardened image preserves expected functionality.

What tools does Game Warden use for SBOM generation and security scanning?

Game Warden uses a comprehensive pipeline of tools to generate your SBOMs and run security checks:

Trivy and Syft: Used for generating SBOMs.
Trivy and Grype: Used for CVE detection and compliance checks.
ClamAV: Used for malware detection.

All security findings from these scanners appear in Findings in the Game Warden web app.

We recommend that you pre-scan your images before pushing to Game Warden. Open-source tools such as Trivy and Grype can identify most issues surfaced by our platform scanners. These tools are cost-effective and well-suited for early testing, even though they may not catch certain DOW-specific findings.