5.7Testing Minimal Images

Verify your minimal images meet security requirements:

# Test 1: No shell available
docker run --rm myapp:latest /bin/sh -c "echo pwned" 2>&1 | grep -q "not found"
echo "PASS: No shell in image"

# Test 2: Running as non-root
USER_ID=$(docker run --rm myapp:latest id -u 2>/dev/null || echo "no id command")
if [ "$USER_ID" != "0" ]; then
    echo "PASS: Not running as root (UID: $USER_ID)"
fi

# Test 3: Image size under threshold
SIZE=$(docker image inspect myapp:latest --format '{{.Size}}')
MAX_SIZE=$((200 * 1024 * 1024))  # 200MB
if [ "$SIZE" -lt "$MAX_SIZE" ]; then
    echo "PASS: Image size $(($SIZE / 1024 / 1024))MB is under 200MB"
fi

# Test 4: Scan for vulnerabilities
trivy image --exit-code 1 --severity CRITICAL myapp:latest
echo "PASS: No critical vulnerabilities"

Automated Image Compliance in CI

# .github/workflows/image-compliance.yml
- name: Check image size
  run: |
    SIZE=$(docker image inspect myapp:${{ github.sha }} --format '{{.Size}}')
    MAX=$((200 * 1024 * 1024))
    if [ "$SIZE" -gt "$MAX" ]; then
      echo "Image size $(($SIZE / 1024 / 1024))MB exceeds 200MB limit"
      exit 1
    fi

- name: Check non-root user
  run: |
    docker run --rm myapp:${{ github.sha }} whoami | grep -v root

The investment in minimal images pays dividends across security (fewer CVEs), performance (faster pulls), and cost (less storage). Make it a default, not an optimization.