Architecture
Before & After
Before
Scattered security tools requiring manual execution and correlation, no unified dashboard for findings, and inconsistent policy enforcement across containerized workloads.
After
Centralized security hub with automated scanning pipelines, normalized vulnerability findings across all tool integrations, and real-time policy enforcement dashboards. Supports both external and internal network scanning.
Results
Technical Challenge
Normalizing Vulnerabilities Across Different Scanners
The Problem
Each security tool (ZAP, Nuclei, Trivy, etc.) reports vulnerabilities in completely different formats. A SQL injection might be "POC-SQL-INJECTION-001" in Nuclei, "40026" in ZAP, and "CVE-2021-12345" in another. Correlating findings across tools was impossible.
The Solution
Built a normalization layer that maps each tool's output to a common schema (based on OWASP's common vulnerability scoring). The system extracts CVE identifiers, CWE weakness types, and severity scores into a unified format. A deduplication algorithm groups similar findings, reducing noise by 60% while preserving unique vulnerability instances.
Tech Decisions
Flask for Simplicity
OpsShield needed to be self-hosted with minimal overhead. Flask's lightweight footprint means it runs comfortably on a $10/month VPS alongside the Docker containers it monitors. No async complexity needed—security scans are batch jobs, not real-time streams.
Docker Network Integration
Connecting to containers requires accessing the Docker socket or using Docker's API. I chose to run the scanner inside the same Docker network as target containers, allowing internal service scanning without exposing services to the public internet.
Coolify for Self-Hosting
Coolify provides GitOps-style deployments without needing to manage Kubernetes. One-click rollback, automatic TLS, and built-in health checks mean I can update the platform without downtime. It's the perfect match for self-hosted security tooling.