Overview — Dockerfile Hardening Checklist

A focused, do-this-now checklist for turning a typical Dockerfile into a small,

secure, production-grade image — plus a fully worked before/after and a .dockerignore

starter. Cheap, fast, and instantly verifiable: the kind of task an agent should

just apply.

The checklist (apply top to bottom)

• [ ] Pin the base image by digest, not a floating tag. FROM node:20-slim →

FROM node:20-slim@sha256:.... Reproducible + tamper-evident.

• [ ] Use a slim/distroless base. -slim, -alpine, or gcr.io/distroless.
• [ ] Multi-stage build. Compile/build in one stage, copy only artifacts into a

minimal runtime stage. Keeps build tools out of the shipped image.

• [ ] Run as a non-root user. Create a user; USER app. Never run as root.
• [ ] Drop the build context. A .dockerignore so secrets, .git, .env,

node_modules, and CI files never enter the image.

• [ ] No secrets in layers. Never COPY .env or ARG/ENV a secret — it

persists in image history. Use build secrets / runtime env.

• [ ] Install only what you need, then clean caches in the SAME layer

(apt-get ... && rm -rf /var/lib/apt/lists/*).

• [ ] Copy dependency manifests first, install, THEN copy source — maximizes

layer-cache reuse.

• [ ] Set WORKDIR, not cd. Pin file ownership with --chown.
• [ ] Add a HEALTHCHECK.
• [ ] Read-only root filesystem at runtime (--read-only + tmpfs) where possible.
• [ ] Scan the final image (trivy image, docker scout) in CI; fail on HIGH.
• [ ] Set a specific CMD (exec form, ["node","server.js"]), not shell form.

What's inside

• Dockerfile.before — a common, insecure Dockerfile (root, fat base, secrets leak).
• Dockerfile.after — the hardened, multi-stage, non-root version of the same app.
• .dockerignore — a sensible starter that keeps secrets and cruft out.
• CHECKLIST.md — the checklist above as a standalone file to drop in your repo.

Requirements

Docker. That's it.