dockerfile-hardening

Dockerfile Hardening

Secure Dockerfile patterns, multi-stage builds, minimal base images, and build-time security practices.

Knowledge Base

Container Image Security Model

A container image is a stack of filesystem layers. Each Dockerfile instruction creates a layer. Security implications:

• Layers are permanent. Even if you RUN rm /secret in a later layer, the file exists in the layer where it was created. Anyone with docker history or dive can extract it.
• Layers are shared. If two images share a base, they share layers. A vulnerability in the base affects all derived images.
• The build context is sent to the daemon. Without .dockerignore, your entire directory (including .env, .git, node_modules) is sent to the Docker daemon.

Base Image Hierarchy (Most to Least Secure)

Base	Size	Packages	Debug Tools	Use Case
scratch	0 MB	None	None	Statically compiled Go/Rust binaries
gcr.io/distroless/*	2-20 MB	Runtime only (glibc, libssl)	None	Java, Python, Node.js runtimes
cgr.dev/chainguard/*	5-30 MB	Minimal, hardened, daily-patched	Minimal	Production workloads needing updates
alpine	5 MB	musl, busybox, apk	Basic shell	General purpose, small footprint
debian-slim	75 MB	glibc, apt, basic utils	Some	When Alpine compatibility issues arise
ubuntu	75 MB	Full distribution	Full	Development, not recommended for production

Patterns

Pattern 1: Multi-Stage Build (Node.js)

# Stage 1: Build
FROM node:22-alpine AS builder
WORKDIR /app

# Install dependencies first (cache optimization)
COPY package.json package-lock.json ./
RUN npm ci --only=production

# Copy source and build
COPY src/ ./src/
COPY tsconfig.json ./
RUN npm run build

# Stage 2: Runtime (distroless)
FROM gcr.io/distroless/nodejs22-debian12:nonroot
WORKDIR /app

# Copy only production artifacts
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/dist ./dist

# Distroless already runs as nonroot (uid 65532)
EXPOSE 3000
CMD ["dist/server.js"]