container-hardening

# Skill: Container Hardening > **Expertise:** Minimal images, distroless, multi-stage builds, security context, Dockerfile best practices, Trivy scanning. ## When to load When building a new Dockerfile, hardening an existing image, failing Trivy scan, or setting up pod security contexts. ## Hardened Dockerfile (Python example) ```dockerfile # ── Stage 1: Build (has build tools, not in final image) ── FROM python:3.12-slim@sha256:<pinned-digest> AS builder WORKDIR /app COPY requirements.txt . RUN pip install --user --no-cache-dir -r requirements.txt # ── Stage 2: Runtime (minimal, no build tools) ─────────── FROM python:3.12-slim@sha256:<pinned-digest> # Create non-root user RUN groupadd -r appgroup --gid=1000 && \ useradd -r -g appgroup --uid=1000 --no-create-home appuser WORKDIR /app # Copy only built artifacts from builder COPY --from=builder /root/.local /home/appuser/.local COPY --chown=appuser:appgroup src/ ./src/ # Remove SETUID binaries (attack surface reduction) RUN find / -perm /6000 -type f -exec chmod a-s {} \; 2>/dev/null || true # Switch to non-root USER 1000:1000 # Read-only filesystem friendly: temp dir for app writes VOLUME ["/tmp"] EXPOSE 8080 # Prefer exec form (handles signals correctly) ENTRYPOINT ["python", "-m", "uvicorn", "src.main:app", "--host", "0.0.0.0", "--port", "8080"] ``` ## Distroless (Go example — smallest attack surface) ```dockerfile FROM golang:1.23-alpine AS builder WORKDIR /app COPY . . RUN CGO_ENABLED=0 GOOS=linux go...