Figure 4-23 Application boundaries Figure 4-24 Isolated components While application boundaries are not essential to this approach, it does make it much easier  to decide where to use what type of security techniques.  In the previous section, we very deliberately used the term “logical” application boundary  because there is nothing yet enforcing that boundary. In reality, the components still float  around insecurely on the network.  The first thing that we need to do it to lock down the individual components. It is likely we are  building our cloud-native solution in a container-based environment. This has the benefit that  containers by default expose no interfaces. Part B. Isolate the application  Chapter 4. Cloud-native concepts and technology  131 If we have not explicitly exposed ports in the Dockerfile the containers are inaccessible even  within the K8s cluster as shown in Figure 4-24 on page 131.  Within the application boundary, some of the components need to talk to one another. We  need to open up at least some of the ports on the components. So, we need to work out how  to avoid those becoming available outside the scope of the application. One option, as shown 