# Docker Security Best Practices: Images, Runtime, and Supply Chain

URL: https://www.devopsness.com/blog/docker-security-best-practices-images-runtime-and-supply-chain
Author: Kiril Urbonas
Published: 2025-06-11
Updated: 2025-06-11
Categories: DevOps
Tags: Kubernetes, Docker, Security

Summary: Harden container images and runtime. Image scanning, minimal base, and supply chain security.

---
# Docker Security Best Practices: Images, Runtime, and Supply Chain

Containers are a big attack surface. These practices reduce risk without slowing delivery.

## 1. Minimal and Updated Base Images

- Prefer **distroless** or **Alpine**; avoid full OS images when possible.
- Pin tags by digest and rebuild regularly for CVEs.

```dockerfile
FROM golang:1.21-alpine AS builder
# build...
FROM gcr.io/distroless/static-debian12
COPY --from=builder /app /app
ENTRYPOINT ["/app"]
```

## 2. Non-Root and Read-Only

- Run as non-root (USER in Dockerfile; runAsNonRoot in Kubernetes).
- Use read-only root filesystem where possible; mount writable dirs only when needed.

## 3. Image Scanning

- Scan in CI (e.g. Trivy, Snyk) and block critical/high CVEs.
- Scan at runtime or in registry and alert on new findings.

## 4. Supply Chain

- Sign images (Cosign, Notary); verify in admission control.
- Prefer private registries and pin base image digests.

Making these standard for every image and deployment significantly improves your security posture.