Guides ยท Engineering
Container Image Hardening Basics
Harden container images
This guide explains building safer container images: minimal bases, pinned package versions, multi-stage builds, non-root users, and regular CVE scanning.
- containers
- image hardening
- cve scanning
- non-root
- docker
Start minimal
Use slim or distroless bases and remove build tools in final images.
Pin and verify
Pin package versions and verify checksums for downloads.
Run as non-root
Set a non-root user and limit capabilities; avoid privileged containers.
Scan and update
Scan images for CVEs regularly and rebuild when fixes land.