Docker Build Security 101

Install docker using the official instructions, update the package manager, install prerequisites, add the docker GPG key, verify with docker run hello-world, and add your user to the docker group.

Learn why securing the Docker build process matters, and apply best practices for writing secure Dockerfiles to prevent vulnerabilities in images and containers, including multi-stage builds.

Build a basic docker image by creating a Python Flask API, writing a docker file, building the image with docker build, and running a container while noting security improvements.

Implement non-root practices in Docker containers by creating a low-privileged user in the Dockerfile and running containers with that user.

Learn how to use the docker copy command safely by copying only necessary files, avoiding secrets, and preventing large, risky image bloat.

Understand how the add command downloads content during docker build, assess risks from untrusted sources and broken links, and prefer the copy command for secure, reliable image creation.

Identify the security risks of untrusted base images and learn to pull official, verified images to ensure timely security updates in Docker builds.

learn to build docker images with minimal base images or scratch to minimize attack surface, and remove unnecessary binaries by auditing installed packages with apk info.

Avoid the latest tag in docker builds to ensure reproducible images; specify exact base image versions, like python 3.9.1-alpine, and lock libraries via requirements.txt for stability and security.

Hardening docker container files by enforcing root ownership and 755 permissions prevents low-privileged users from modifying files, while others have only execute rights, and API verification shows functionality remains.

Discover why secrets should never be embedded in docker images, environment variables, or build args, and learn to use dedicated secret management platforms like Carbonetti secrets and secret worlds.

avoid installing and running administrative services inside Docker build images; containers should run a single process, reducing surface area and preventing potential container escapes.

Discover how multi-stage builds reduce final image size and attack surface by performing builds in an intermediate container and copying only the necessary libraries and binaries to the final image.

Reinforces Docker build security best practices and encourages learners to share the course with colleagues and leave feedback to help improve future sessions.