Docker Security Best Practices: Images, Runtime, and Supply Chain

Containers are a big attack surface. These practices reduce risk without slowing delivery.

1. Minimal and Updated Base Images

• Prefer distroless or Alpine; avoid full OS images when possible.
• Pin tags by digest and rebuild regularly for CVEs.

FROM golang:1.21-alpine AS builder
# build...
FROM gcr.io/distroless/static-debian12
COPY --from=builder /app /app
ENTRYPOINT ["/app"]

2. Non-Root and Read-Only

• Run as non-root (USER in Dockerfile; runAsNonRoot in Kubernetes).
• Use read-only root filesystem where possible; mount writable dirs only when needed.

3. Image Scanning

• Scan in CI (e.g. Trivy, Snyk) and block critical/high CVEs.
• Scan at runtime or in registry and alert on new findings.

4. Supply Chain

• Sign images (Cosign, Notary); verify in admission control.
• Prefer private registries and pin base image digests.

Making these standard for every image and deployment significantly improves your security posture.