Harden container images and runtime. Image scanning, minimal base, and supply chain security.

On this page

Docker Security Best Practices: Images, Runtime, and Supply Chain

Containers are a big attack surface. These practices reduce risk without slowing delivery.

1. Minimal and Updated Base Images #

dockerfile.dockerfile

FROM golang:1.21-alpine AS builder
# build...
FROM gcr.io/distroless/static-debian12
COPY --from=builder /app /app
ENTRYPOINT ["/app"]

Run as non-root (USER in Dockerfile; runAsNonRoot in Kubernetes).
Use read-only root filesystem where possible; mount writable dirs only when needed.

Making these standard for every image and deployment significantly improves your security posture.