Mario Ezquerro for Google Developer Experts

Posted on Sep 17 Originally published at github.com

The Only Container Orchestrator with Built-In Compliance: How Gubernator Enforces ENS, NIS 2, CIS Benchmark, and ISO 27001

#devops #security #docker #kubernetes

🛡️ The Only Container Orchestrator with Built-In Compliance: How Gubernator Enforces ENS, NIS 2, CIS Benchmark, and ISO 27001

Over the past decade, container orchestration has been polarized into two stark extremes:

Kubernetes (K8s) Overengineering: An extraordinarily capable blank canvas, yet born naked of security and regulatory compliance. To bring a Kubernetes cluster into compliance with standards like Spain's Esquema Nacional de Seguridad (ENS) or the European NIS 2 Directive, SecOps teams must assemble, configure, and maintain an intricate tapestry of 15+ third-party tools and operators: Trivy, Falco, Kyverno or OPA Gatekeeper, Cosign, cert-manager, Keycloak, Fluentbit, Prometheus, Grafana, OpenTelemetry... The consequence is astronomical technical debt, operational fragility, and a voracious appetite for RAM and CPU just to run the control plane.
The Bare Minimalism of Docker Swarm and HashiCorp Nomad: Lightweight and elegant solutions for running containers, yet entirely devoid of forensic audit trails, admission control, cryptographic image signing, and regulatory compliance engines.

What happens when a public administration, healthcare provider, critical infrastructure operator, or financial institution needs to deploy containerized workloads meeting the strictest cybersecurity regulations without drowning in operational complexity and exorbitant infrastructure costs?

The answer is Gubernator (gbnt): the first and only container orchestrator designed from the ground up with native enterprise cybersecurity and regulatory compliance.

In this deep dive, we explore Gubernator’s built-in security architecture, the international compliance frameworks it continuously audits in real time, its degradation-detecting watchdog, and why it represents a paradigm shift in technological sovereignty.

🏛️ The Core Philosophy: "Secure & Compliant by Design"

Unlike orchestrators where security is an afterthought retrofitted via third-party plugins, in Gubernator, every Centurion (worker node) and Legion (Docker Compose stack) is governed by an unyielding security framework from the moment it boots:

 ┌─────────────────────────────────────────────────────────────────────────────────────────┐
 │                      GUBERNATOR ENTERPRISE SECURITY & COMPLIANCE ENGINE                 │
 ├─────────────────────────────────────────────────────────────────────────────────────────┤
 │  🇪🇸 ENS RD 311/2022  │  🇪🇺 NIS 2 Directive  │  🔒 CIS Benchmark  │  🌐 ISO 27001:2022  │
 ├──────────────────────┼──────────────────────┼────────────────────┼─────────────────────┤
 │  • op.acc.2 / op.mon │  • Art. 21 Risks     │  • Daemon & Host   │  • A.5 Controls     │
 │  • Basic/Medium/High │  • SIEM Syslog Live  │  • Kernel Seccomp  │  • A.8 Controls     │
 │  • CCN Evidence      │  • Cyber Hygiene     │  • AppArmor/Caps   │  • Formal SoA Rep.  │
 ├──────────────────────┴──────────────────────┴────────────────────┴─────────────────────┤
 │                  🔄 CONTINUOUS COMPLIANCE WATCHDOG DAEMON (15m Interval)               │
 │          - Instant reactive re-evaluation upon any security configuration mutation     │
 │          - Automatic degradation detection (>1.0% drop) -> COMPLIANCE_DEGRADED event   │
 │          - Native Prometheus gauges: gbnt_compliance_score{framework="..."}            │
 ├─────────────────────────────────────────────────────────────────────────────────────────┤
 │                        🔐 IDENTITY, ACCESS & FORENSIC AUDITING                          │
 │  • Active Directory / OpenLDAP (LDAPS:636)    • SSO / OIDC (Google, Okta, Keycloak)     │
 │  • Granular RBAC (Admin, Operator, Auditor)   • MFA/TOTP with Offline Time Beacon       │
 │  • Cryptographic SHA-256 Tamper-Evident Hash Chain Audit Ledger                        │
 ├─────────────────────────────────────────────────────────────────────────────────────────┤
 │                    📦 SOFTWARE SUPPLY CHAIN SECURITY & ADMISSION                        │
 │  • CVE Vulnerability Scanner with CVSS v3     • CycloneDX & SPDX JSON SBOMs             │
 │  • In-Cluster Cosign ECDSA P-256 Signing      • Gatekeeper Admission Controller         │
 └─────────────────────────────────────────────────────────────────────────────────────────┘

Everything runs natively from a single self-contained Go binary with zero heavy external dependencies, managed through a modern, responsive Flutter Web Dashboard.

📋 1. Esquema Nacional de Seguridad (ENS - Royal Decree 311/2022)

The Esquema Nacional de Seguridad (ENS) regulates the security conditions that Spanish Public Administrations and their technology partners must fulfill to safeguard information systems and services.

Gubernator natively assesses the operational controls specified by Spain's CCN-STIC standards:

op.acc.2 (Access Control & Credential Hardening):
- Configurable minimum password length validation (default 12+ characters).
- Enforced complexity (uppercase, lowercase, digits, and special characters).
- Automatic account lockout after repeated failed login attempts.
- Idle session expiration and timeout enforcement.
op.acc.6 (Strengthened Authentication):
- Mandatory Multi-Factor Authentication (MFA/TOTP RFC 6238) for administrative and operational roles.
op.mon.1 (System Monitoring & Logging):
- Cryptographically signed audit trails and live security event streaming to enterprise SIEM platforms.
op.exp.8 (Integrity Protection & Cryptographic Chains):
- Mathematical integrity verification across the action history via cryptographic hash chains.

Gubernator automatically evaluates compliance across the three official ENS tiers (Basic, Medium, and High) and produces a ready-to-present CCN evidence dossier in a single click.

🇪🇺 2. European NIS 2 Directive (EU Directive 2022/2555)

The European Union's NIS 2 Directive establishes a harmonized cybersecurity baseline across essential and important entities, introducing strict penalties for non-compliance with risk management and incident reporting obligations.

Gubernator directly addresses the requirements of Article 21 (Cybersecurity risk-management measures):

Risk Analysis & Information System Security Policies: Continuous monitoring of image admission modes and cluster security settings.
Incident Handling & Real-Time SIEM Streaming:
- Native RFC 5424 and RFC 3164 Syslog forwarder dispatching security events directly to Splunk, Elastic, Microsoft Sentinel, Wazuh, or QRadar.
- Automatic dispatch on policy violations, brute-force lockouts, and compliance degradation.
Business Continuity & Consistent Backups: Integrated with Gubernator's The Granaries subsystem, allowing operators to freeze containers (docker pause), create encrypted .tar.gz snapshots verified with SHA-256 digests, and manage automated retention schedules.
Supply Chain Security: Image validation prior to task scheduling to thwart dependency injection attacks.
Cryptography & Encryption: Enforced mTLS and X.509 certificate lifecycle management on the Ingress proxy with automated certificate renewal.

The dashboard presents dedicated compliance gauges for both Essential Entities (EE) and Important Entities (IE) with live breakdowns of all 10 Article 21 requirements.

🔒 3. CIS Docker Benchmark v1.6.0

The Center for Internet Security (CIS) maintains the industry benchmark for hardening Docker hosts and container runtimes.

Gubernator embeds an automated CIS evaluation engine spanning all 6 core benchmark domains:

Section 1 (Host Configuration): Dedicated partition verification for /var/lib/docker, auditd system call tracking, and daemon isolation.
Section 2 (Docker Daemon Configuration): Inter-container communication restrictions on the default bridge (icc=false), user namespace remapping (userns-remap), log rotation policies (max-size, max-file), and deprecation of legacy registry support.
Section 3 (File Permissions and Ownership): Strict permissions verification (0644, 0600) and root:root ownership on /etc/docker/daemon.json, sockets, and TLS keys.
Section 4 (Images and Build Files): Verification of non-root USER execution, detection of embedded credentials, and prevention of compiler binaries inside runtime containers.
Section 5 (Runtime Security):
- Enforcement of default AppArmor profiles and Seccomp filters.
- Linux capability minimization (--cap-drop=ALL).
- Read-only root filesystems (read_only: true).
- Prevention of privilege escalation (no-new-privileges: true).
Section 6 (Security Operations): Housekeeping for orphaned volumes, zombie containers, and deprecated runtime parameters.

Each CIS check outputs its status (PASS, WARN, FAIL, INFO), alongside raw technical evidence and step-by-step remediation advice.

🌐 4. ISO/IEC 27001:2022 (Annex A)

ISO/IEC 27001 is the global benchmark for Information Security Management Systems (ISMS).

Gubernator evaluates the updated Annex A controls (2022 revision):

Theme A.5 (Organizational Controls):
- A.5.15 / A.5.18: Role-based access control and segregation of privileged rights.
- A.5.24 - A.5.28: Incident management workflow and forensic evidence collection.
Theme A.8 (Technological Controls):
- A.8.2: Privileged access rights monitored and managed.
- A.8.8: Technical vulnerability remediation across production stacks.
- A.8.9: Configuration management and cluster hardening.
- A.8.15: Tamper-resistant logging and event recording.
- A.8.28: Secure coding and declarative configuration validation.

From the web console, teams can export a formal Statement of Applicability (SoA) with real-time audit statuses ready for external certification audits.

🔄 5. Continuous Compliance Watchdog: Zero Blind Spots

Traditional compliance auditing relies on periodic, point-in-time reviews: an external auditor visits today, and until the next quarter, nobody knows whether security configurations have quietly drifted out of compliance.

In Gubernator, compliance is an active, continuous process:

 [ Security Configuration Mutation ] ──▶ Reactive Out-of-Band Trigger
 (e.g., MFA disabled,                    │
  password policy relaxed,               ▼
  SIEM endpoint altered)      ┌─────────────────────────┐
                              │   Compliance Watchdog   │◀── Background Cron (15m)
                              └────────────┬────────────┘
                                           │
                             Did score drop > 1.0%?
                              ├── YES ──▶ 🚨 Audit Log: COMPLIANCE_DEGRADED (WARNING)
                              └── NO  ──▶ ℹ️ Audit Log: COMPLIANCE_RESTORED (SUCCESS)
                                           │
                                           ▼
                              📊 Prometheus: gbnt_compliance_score
                              🖥️ Web UI: Executive Matrix Synchronized

What happens if an admin relaxes security settings?

If an operator disables MFA for a user or lowers the cluster password complexity threshold:

Instant Reactive Re-evaluation: Rather than waiting for the 15-minute background interval, the API immediately fires go security.TriggerComplianceAudit(...).
Cryptographic Drift & Degradation Alert: The engine compares the previous score with the new evaluation. If it detects a drop greater than 1.0%, it registers a forensic warning:

   {
     "event": "COMPLIANCE_DEGRADED",
     "severity": "WARNING",
     "message": "Compliance score degraded in Spanish ENS (RD 311/2022): dropped from 96.9% to 88.5% (trigger: MFA_DISABLED)"
   }

Prometheus Metrics (:4002/metrics):

   # HELP gbnt_compliance_score Current compliance score (0.0 to 100.0) evaluated by the continuous compliance audit engine.
   # TYPE gbnt_compliance_score gauge
   gbnt_compliance_score{framework="cis_docker"} 75.0
   gbnt_compliance_score{framework="ens"} 88.5
   gbnt_compliance_score{framework="iso27001"} 97.9
   gbnt_compliance_score{framework="nis2"} 91.7

Live Dashboard Executive Matrix: The top header badge confirms ● WATCHDOG ACTIVE alongside the [ 🛡️ Re-evaluate All Compliance ] master button to trigger an on-demand audit cycle in one click.

🔐 6. Tamper-Evident Forensic Audit Trail (SHA-256 Hash Chain)

Advanced attackers who breach a system frequently attempt to wipe or modify audit logs to cover their tracks.

To prevent log tampering, Gubernator implements an immutable forensic ledger:
Every log entry stored in SQLite contains:

PreviousHash: The SHA-256 hash of the immediately preceding event.
EventHash: The cryptographic checksum computed over the event payload: $$\text{Hash}n = \text{SHA-256}(\text{Hash}{n-1} \parallel \text{Timestamp} \parallel \text{Actor} \parallel \text{IP} \parallel \text{Category} \parallel \text{Action} \parallel \text{Status} \parallel \text{Details})$$

Clicking "Verify Forensic Chain" traverses the entire audit history, recalculating every cryptographic link. If an unauthorized actor modifies a row directly in the database, the hash chain breaks instantly, flagging the exact corrupted record.

📦 7. Supply Chain Security: SBOMs, CVE Scanning, and Cosign

Software cannot be considered secure if you don't know what is running inside your containers.

Gubernator delivers deep software supply chain inspection out of the box:

Software Bill of Materials (SBOM):
- Instant export in standard CycloneDX JSON and SPDX JSON formats.
- Comprehensive inventory of OS packages, runtime language dependencies (Go, Python, Node.js, Rust, Java), and license compliance (GPL, Apache, MIT).
CVE Vulnerability Scanning:
- Image analysis against official vulnerability feeds with CVSS v3 severity scoring and automated patch recommendations.
Cryptographic Signing via Cosign (Sigstore):
- In-cluster generation of ECDSA P-256 keypairs without external tooling.
- Cryptographic signing and digest verification directly integrated into deployment pipelines.
Security Gatekeeper (Admission Controller):
- Declarative pre-deployment admission policies that block unsigned images or containers containing unpatched critical vulnerabilities.

🔑 8. Enterprise Identity, RBAC, and Resilient MFA (Time Beacon)

Enterprise Directory Integration (LDAP/LDAPS): Direct connection to Microsoft Active Directory and OpenLDAP over LDAPS (port 636) and StartTLS, mapping external directory groups to Gubernator cluster roles.
Single Sign-On (SSO / OIDC): Built-in authentication support for Google Workspace, Keycloak, Okta, Authentik, and Azure AD.
Role-Based Access Control (RBAC):
- 👑 admin: Full administrative control over cluster nodes, signing keys, TLS certs, and security policies.
- ⚡ operator: Stack authoring, service scaling, container restarts, and terminal shell access.
- 🔍 auditor: Forensic audit inspection for ENS, NIS 2, CIS, and ISO 27001 evidence without mutation privileges.
- 👁️ readonly: Visual monitoring of dashboards and telemetry.
Laptop Clock-Drift Compensation (Time Beacon):
- A notorious issue with virtualized environments (Multipass, VMware, VirtualBox) is that closing a laptop lid suspends the host and causes VM clock desynchronization, immediately breaking TOTP MFA codes (RFC 6238).
- Gubernator features a Time Beacon mechanism: the browser transmits a client-side timestamp reference during login. If clock drift is detected, Gubernator validates the token and hot-syncs the VM host kernel clock on the fly—100% offline without needing internet access.

⚔️ Comparison Matrix: Why Gubernator Stands Alone

Security & Compliance Feature	Kubernetes (K8s)	Docker Swarm	HashiCorp Nomad	Gubernator (`gbnt`)
Deployment Simplicity	❌ Extreme Complexity	✅ Very Simple	⚠️ Moderate	✅ Dead Simple (1 Binary)
Native Compose Support	❌ No (Requires Kompose/CRDs)	✅ Yes	❌ No (Custom HCL)	✅ Yes (Native)
Spanish ENS (RD 311/2022)	❌ No (Requires bespoke audits)	❌ No	❌ No	🟢 Native (Basic/Medium/High)
EU NIS 2 Directive (Art. 21)	❌ No native engine	❌ No	❌ No	🟢 Native (EE & IE)
Automated CIS Docker Benchmark	⚠️ Via plugins (Kube-bench)	❌ No	❌ No	🟢 Native (6 CIS Domains)
ISO/IEC 27001 (Automated SoA)	❌ No	❌ No	❌ No	🟢 Native (Annex A)
Continuous Compliance Watchdog	❌ No	❌ No	❌ No	🟢 Native (Cron + Triggers)
Compliance Degradation Alerts	❌ No	❌ No	❌ No	🟢 Native (>1% Drop Alert)
SIEM Syslog Forwarder (RFC 5424)	⚠️ Via heavy logging agents	❌ No	❌ No	🟢 Native in Core
Tamper-Evident SHA-256 Ledger	❌ No	❌ No	❌ No	🟢 Native Hash Chain
In-Cluster Cosign ECDSA Signing	⚠️ Via Kyverno/Cosign	❌ No	❌ No	🟢 Native Key Management
CycloneDX / SPDX SBOM Generator	⚠️ Via external scanners	❌ No	❌ No	🟢 Native One-Click Export
Idle Memory Consumption per Node	~1.5 GB - 3 GB	~100 MB	~150 MB	🟢 < 60 MB

🚀 Conclusion: Sovereign, Simple, and Certified

Gubernator proves that organizations do not have to accept either the runaway complexity of Kubernetes or the security void of minimalist orchestrators.

By embedding the world's most rigorous compliance frameworks (Spanish ENS RD 311/2022, European NIS 2, CIS Docker Benchmark, and ISO/IEC 27001) directly alongside a continuous compliance watchdog, cryptographic Cosign signing, standardized SBOM generation, and a tamper-evident SHA-256 audit ledger, Gubernator stands as the only container orchestrator on the market that delivers radical simplicity and certified cybersecurity right out of the box.

If you operate in regulated industries, government agencies, healthcare, defense, or simply believe your infrastructure security shouldn't rely on 20 fragile plugins stitched together with duct tape, give Gubernator a run:

👉 Project Repository: https://github.com/mario-ezquerro/gubernator

⭐ If you find this project valuable, star the repo and join our journey towards sovereign cloud-native computing!

DEV Community