Container Security Hardening

Container Security Hardening

Hardening container images and deployments — from minimal base images through vulnerability scanning, runtime security, and Kubernetes Pod Security Standards.

When to Use

• Reducing attack surface of container images
• Scanning for vulnerabilities in container images
• Running containers with least privilege
• Implementing Kubernetes pod security
• Building secure CI/CD container pipelines

Hardening Practices

CONTAINER_HARDENING = {
    'base_images': 'Use distroless (Google) or scratch, avoid full OS images',
    'non_root': 'USER nobody in Dockerfile, never run as root',
    'read_only': 'Read-only root filesystem, tmpfs for what needs write',
    'minimal_layers': 'Single RUN apt, multi-stage builds, squashing layers',
    'scanning': 'Trivy, Grype, Clair in CI — fail builds on critical CVEs',
}

DOCKERFILE_SECURE = """
# Multi-stage: build stage
FROM golang:1.21 AS builder
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 go build -o app .

# Distroless runtime stage
FROM gcr.io/distroless/static-debian12:nonroot
COPY --from=builder /app/app /app
USER nonroot:nonroot
EXPOSE 8080
ENTRYPOINT ["/app"]
"""

Verification Checklist

• Base image is minimal (distroless or scratch)
• Container runs as non-root user
• Root filesystem is read-only
• Image scanned for vulnerabilities (Trivy/Grype)
• No sensitive data in image (env vars, secrets)
• Seccomp/apparmor profiles applied
• Resource limits set (CPU, memory)
• Image signed and verified in deployment