# Container Image Hardening

> Harden Dockerfiles and container images — multi-stage builds, non-root users, minimal base images, and vulnerability gates. Use when building production containers or reviewing Dockerfiles.

- Skill: `securityskills/container-image-hardening` (Agent Skill)
- Install (CLI): `npx skillmds@latest add securityskills/container-image-hardening`
- Raw SKILL.md: https://api.skillmd.com/api/skills/securityskills/container-image-hardening/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: securityskills (https://skillmd.com/u/securityskills)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/securityskills/container-image-hardening

---


# Container Image Hardening

Review and fix Dockerfiles and images for production safety.

## Dockerfile Review Checklist

- **Base image**: official, specific tag or digest, minimal variant (`alpine`, `distroless`, `slim`); never `latest`
- **Multi-stage builds**: build toolchains (compilers, package managers) excluded from final image
- **Non-root user**: `USER` directive with a dedicated UID; no sudo in image
- **No secrets**: no `ENV` with credentials, no `COPY .env`, no secrets baked into layers (they persist even if deleted later)
- **Pinned dependencies**: lockfiles used (`npm ci`, `pip install -r requirements.txt` with hashes)
- **Healthchecks** defined; `ENTRYPOINT` over `CMD` for enforced init
- **Layer hygiene**: combine apt operations and clean lists in one layer; `.dockerignore` covers `.git`, build artifacts

## Scan and Gate

```bash
trivy image --severity HIGH,CRITICAL --exit-code 1 <image>
grype <image>
docker scout cves <image>
```

- Fail CI on critical CVEs with available fixes
- Track base image updates (renovate/dependabot for Dockerfiles)

## Runtime Hardening

```yaml
read_only: true
cap_drop: ["ALL"]
security_opt: ["no-new-privileges:true"]
tmpfs: [/tmp]
```

- Resource limits set (CPU/memory) to blunt DoS
- Root filesystem read-only; writable paths explicit tmpfs

## Verification

- `docker history <image>` — no secret-looking layers
- `dive <image>` — image efficiency and wasted space
- Run as the image user: `docker run --rm <image> id` shows non-root

## Output

Hardened Dockerfile, scan report before/after, and CI gate configuration.