Container Image Security

Container images have their own supply chain security risks beyond application-level vulnerabilities.

Using :latest tags:

FROM node:latest  # Which version? Unpredictable!
# Next week, node:latest might be a different major version
# Breaking changes, new vulnerabilities, or backdoored image

Unverified base images:

# FROM some-random-docker-hub-user/ubuntu-node:20
# Who published this? Is it maintained? Does it contain malware?

# Even official images can have CVEs — always scan!
docker scan myapp:latest
grype myapp:latest  # Checks for known CVEs in image layers

Secrets in image layers:

# DANGEROUS: secrets in RUN commands are stored in image layers
RUN pip install mypackage && rm /etc/secrets  # secrets still in layer!

FROM base AS builder
COPY secrets /etc/secrets  # Secret in builder layer — extractable!
RUN build-step

# Even in multi-stage, if you COPY from builder containing secrets...
docker history myapp:latest  # Shows all layer commands
docker save myapp:latest | tar xvf - | examine_layers

Use pinned image digests, minimal base images, and multi-stage builds to create secure, reproducible containers.

Pin images by digest (immutable):

# By tag (mutable — can change!):
FROM node:20-alpine

# By digest (immutable — exact image, always):
FROM node:20-alpine@sha256:a7db2bea9b2e77c6d2ee46ad4bf78f56d7e88b18b07a28f5b2e8e6c618d6cfd4

# Get current digest:
docker pull node:20-alpine
docker inspect node:20-alpine --format='{{index .RepoDigests 0}}'

Multi-stage build — no secrets in final image:

FROM node:20-alpine AS builder
# Build step — may use build secrets
# --mount=type=secret makes secrets available without storing in layers
RUN --mount=type=secret,id=npm_token \
    NPM_TOKEN=$(cat /run/secrets/npm_token) npm ci
RUN npm run build

# Final image — no build tools, no secrets
FROM gcr.io/distroless/nodejs20-debian12
COPY --from=builder /app/dist /app/dist
COPY --from=builder /app/node_modules /app/node_modules
# Distroless: no shell, no package manager, minimal attack surface
USER nobody
CMD ["/app/dist/server.js"]