Container Orchestration

What it is

Every modern LLM deployment runs on container infrastructure. The substrate layer is technically not LLM-specific: the Docker daemon, etcd (k8s/standalone), HashiCorp Vault (secrets), HashiCorp Consul (service mesh), Portainer (UI), Argo CD (continuous deployment), and the kubelet itself. Unauthenticated exposure here is sometimes more impactful than exposure of the LLM service it carries. Docker socket exposure = container escape = root on host. etcd unauth = full k8s state dump. Vault uninitialized = anyone calls /v1/sys/init and becomes the operator.

What goes wrong

The framework defaults vary across the layer:

• Docker daemon on TCP 2375 ships without auth in the official documentation’s “remote API” examples; operators copy-paste the config and forget the TLS step. Population-scale unauth rate: high.
• etcd v2 API (/v2/keys) ships without auth in older deployments; v3 default is gRPC-auth-on but operators frequently turn it off.
• Vault is auth-on-default at the framework layer; the only unauth surface is the /v1/sys/init bootstrap endpoint, which is intentionally open until the first init call. Uninitialized Vaults are a one-shot full-takeover surface.
• Consul ships with ACLs disabled by default in framework config (Tier-A**); 100% of reachable Consul instances at population scale have ACL off.
• Argo CD is auth-on-default (Tier-C). 99.93% of the population is properly gated; ~0.07% set the anonymous-read template-config and leak app inventories.

How we test

Each substrate platform has its own identity-and-state probe. Docker: GET /version. etcd: GET /version + GET /v2/keys?recursive=false (top-level keys only). Vault: GET /v1/sys/seal-status + GET /v1/sys/init (sealed / unsealed / uninitialized). Consul: GET /v1/agent/self + GET /v1/catalog/services. We never read secret values, never PUT/DELETE/POST /v1/sys/init. The presence of the substrate at the public boundary is the finding; the operator’s k8s topology, secret-engine mounts, and service catalog leak as metadata even when the data layer is gated.