Defense-in-Depth for Containerized Web Applications: Experimental Evaluation of Web Application Firewall and Docker Hardening against Command Injection

Background: Web applications deployed in modern infrastructure remain vulnerable to command injection and remote code execution attacks, particularly when security controls are applied independently. Containerization improves deployment flexibility but introduces additional risks related to privilege escalation and runtime compromise. Objective: This study aims to evaluate the effectiveness of a defense-in-depth approach by integrating a Web Application Firewall (WAF) and Docker container hardening to mitigate command injection and runtime exploitation risks. Methods: An experimental evaluation was conducted using three deployment configurations: a legacy virtual machine (VM), a containerized application without hardening, and a WAF-protected, hardened container. The assessment followed the NIST SP 800-115 framework, combining automated vulnerability assessment using OWASP ZAP with controlled command injection testing involving 3,000 malicious payloads. Security performance was evaluated based on vulnerability findings, attack-blocking capability, exploitation outcomes, and system response performance. Results: The findings show that the combined WAF and Docker hardening configuration reduced the number of high-severity vulnerabilities from three findings to one. The WAF successfully blocked 2,251 of 3,000 command injection payloads, while container hardening prevented privilege escalation and host access during post-exploitation testing. The implemented security layers maintained stable system performance with minimal overhead. Conclusion: Integrating a WAF and Docker hardening provides a practical defense-in-depth strategy for strengthening containerized web applications against injection-based attacks. This approach improves attack prevention and runtime containment, although further validation using broader attack scenarios and repeated experiments is recommended.