5.6Security Hardening Checklist

Beyond choosing a minimal base image, apply these hardening practices:

Run as Non-Root

# Create a non-root user
RUN useradd --create-home --shell /bin/false --uid 1001 appuser
USER appuser
# or for Alpine:
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
USER appuser

Read-Only Filesystem

# Kubernetes: mount filesystem as read-only
securityContext:
  readOnlyRootFilesystem: true
# If the app needs to write temp files:
volumeMounts:
  - name: tmp
    mountPath: /tmp
volumes:
  - name: tmp
    emptyDir: {}

Drop All Capabilities

securityContext:
  capabilities:
    drop: ["ALL"]
  # Add back only what you need:
  # add: ["NET_BIND_SERVICE"]  # If binding to port < 1024

Pin Image Digests

# BAD: tags can be overwritten
FROM node:20-slim

# GOOD: digests are immutable
FROM node:20-slim@sha256:abc123def456...

# Best practice: use a .env or CI variable for the digest
ARG NODE_IMAGE_DIGEST=sha256:abc123def456...
FROM node:20-slim@${NODE_IMAGE_DIGEST}