Build verifiable artifacts
Harden container images
Use trusted minimal bases, pin image identity, build without secrets, scan final layers, and run with reduced runtime privileges.
8 minute lesson
A container image is a release artifact with its own operating-system packages and history. Review the final image, not only the Dockerfile.
Use supported base images, pin a digest where stability matters, and rebuild for security updates. Keep compilers and package caches out of the runtime stage. Never bake secrets into layers, and run as a non-root user when the application supports it.
A Dockerfile copies .npmrc, installs private packages, and deletes the file in the next instruction. The credential remains recoverable from the earlier layer.
A minimal image reduces packages and findings, but it can make diagnosis harder. Keep a separate debugging path instead of shipping compilers and shells in every production image.
Inspect one final image for layers, packages, configured user, entry point, and embedded secrets, and save the results. Rebuild it with a secret mount and a separate runtime stage, then prove the credential is absent. Start the container as its configured non-root user and test one operation that should fail without elevated privileges.
Lesson completed