content_image/986017.jpg content_image/986018.jpg
<img src='content_image/986017.jpg'>

While application boundaries are not essential to this approach, it does make it much easier to decide where to use what type of security techniques. 

## Part B. Isolate the application 

In the previous section, we very deliberately used the term “logical” application boundary because there is nothing yet enforcing that boundary. In reality, the components still float around insecurely on the network. 

The first thing that we need to do it to lock down the individual components. It is likely we are building our cloud-native solution in a container-based environment. This has the benefit that containers by default expose no interfaces. 

<img src='content_image/986018.jpg'>

If we have not explicitly exposed ports in the Dockerfile the containers are inaccessible even within the K8s cluster as shown in Figure 4-24 on page 131. 

Within the application boundary, some of the components need to talk to one another. We need to open up at least some of the ports on the components. So, we need to work out how to avoid those becoming available outside the scope of the application. One option, as shown 

