Recent reports of quickly exploited software flaws got me thinking about container images too. What practical steps are you taking to reduce what ships and limit the impact if something is still vulnerable?
What are you doing to keep container images lean?
Asked by
murmurcoil
Answers
Start with a multi-stage build. Keep compilers and build tools in the build stage, then copy only the application and its runtime requirements into the final image. A slim or distroless base can help, provided your app works with it. Running as a non-root user is another easy win.
Reply to this answer
Small images help, but you still need to know what is in them. Generate an inventory, scan it in the build pipeline, and make image updates part of a regular process. Prioritize issues that affect packages your app actually uses, then rebuild and redeploy promptly. A scanner that nobody follows up on is just noise.
Reply to this answer
Keep defenses around the container too. Restrict Linux capabilities, use a read-only filesystem where practical, apply network policies, and keep secrets out of the image. An ingress filter can help with some traffic, but it does not patch a vulnerable app or replace updating the image.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions