Container Security Best Practices for Production

Container Security Lifecycle

Security must be addressed at every stage of the container lifecycle: build, ship, and run.

Build Phase

Minimal Base Images

Use minimal base images to reduce attack surface:

FROM node:20-alpine AS builder

WORKDIR /app

COPY package*.json ./

RUN npm ci --only=production

COPY . .

RUN npm run build

FROM node:20-alpine

RUN addgroup -g 1001 -S appgroup && adduser -S appuser -u 1001

COPY --from=builder /app/dist ./dist

COPY --from=builder /app/node_modules ./node_modules

USER appuser

EXPOSE 3000

CMD ["node", "dist/index.js"]

Image Scanning

Scan images for vulnerabilities before pushing:

docker scout cves myimage:latest

trivy image myimage:latest

Ship Phase

Run Phase

Conclusion

Container security is a shared responsibility between development and operations teams.