Base
Hardened build
minimal ports, security patches applied at build time
OWASP Threat Dragon on Ubuntu 24.04 LTS
Azure
Security
OWASP Threat Dragon, the open source threat modelling tool that turns a data flow diagram of your system into a documented set of threats and mitigations.
Overview
OWASP Threat Dragon is the OWASP Foundation's free and open source threat modelling application. You draw a data flow diagram of the system you are designing, marking the processes, data stores, external actors and the trust boundaries between them, and then record the threats against each element. Threats can be elicited with STRIDE, LINDDUN, CIA, DIE or PLOT4ai, and each one carries a description, a severity, a status and the mitigation you intend to apply. The finished model renders as a report you can hand to a review board or attach to a design document, and the model itself is plain JSON, so it can live alongside the code it describes and be diffed in review like any other artefact.
Why the cloudimg image
Threat Dragon signs users in through an external identity provider or runs as a local session, and cloudimg ships the local session mode so no third party OAuth client secret is ever baked into the image. Because that mode has no account store of its own, the whole application is placed behind HTTP Basic Auth at the reverse proxy, and the password is generated uniquely on each instance at first boot, alongside the application's own encryption key and its two JSON Web Token signing keys. Nothing secret exists in the image itself, and the application service is held back until those per instance secrets have been written, so no instance is ever reachable on a shared or default credential. The application listens on loopback only behind a single hardened public listener, and an unauthenticated health endpoint is kept open for load balancers. Every deployment ships fully patched, with a paired deploy guide and 24/7 cloudimg support.
Common uses
- Threat model a new system design with STRIDE before it is built
- Keep threat models in version control next to the code they describe
- Produce a threat and mitigation report for a security design review
See it running
Real screenshots taken while testing this image against its deployment guide.
More in Security
AliasVault Self-Hosted Password Manager & Aliases
Security
The cloudimg image ships the free and open source, AGPL-3.0 licensed AliasVault, run the officially supported way as the...
Apache Directory Server LDAP - Managed Support
Security
This image runs Apache Directory Server (ApacheDS) 2.0, the Apache Software Foundation's extensible, embeddable director...
Apache SpamAssassin Anti-Spam Filter
Security
This image runs Apache SpamAssassin, the open source, Apache-2.0 licensed anti-spam platform.
Authentik - Self-Hosted Identity Provider and SSO Platform
Security
Authentik is an open source identity provider: single sign-on, multi-factor authentication, user management and access c...
Authgear - Open Source Identity Provider
Security
This image runs Authgear, the open source authentication server and identity provider.
Bl
Beelzebub Low-Code Honeypot Framework
Security
This image runs Beelzebub, the open source low code honeypot and deception framework.