WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
WeAreDevelopers LIVE • Feb 3, 2021

A practical guide to writing secure Dockerfiles

Madhu Akula

Hardcoded credentials and bloated base images are quiet supply chain killers. Lock down your Dockerfiles using minimal images, secure credential mounting, and dynamic OPA policies.

Pause
Mute Enter Fullscreen
#1 about 5 min

Introduction to Docker and container deployment foundations

How Dockerfiles script the deployment environment to package scalable and portable applications.

#2 about 3 min

Understanding Dockerfile structure and cloud environment security risks

How hardcoded secrets and misconfigured instructions in Dockerfiles compromise entire cloud environments.

#3 about 5 min

Docker official best practices for container image architecture

Implementing minimal base images, build caching, and multistage structures to reduce container vulnerabilities.

#4 about 5 min

Applying tactical security configurations to Docker container layers

Applying specific package manager flags, non-root users, and absolute image tags to minimize runtime exploits.

#5 about 5 min

Passing credentials securely with Docker BuildKit ephemeral mounts

Mounting AWS credentials and SSH sockets securely during image builds without exposing them in container history.

#6 about 3 min

Automating security best practices with Dockerfile static linters

Utilizing static linting tools like Hadolint to automatically detect unoptimized patterns such as improper file insertions.

#7 about 3 min

Auditing container configurations against CIS benchmark security standards

Validating Docker images against CIS benchmarks to catch root user privileges and exposed environmental secrets.

#8 about 2 min

Minimizing image size and generating automated security profiles

Using DockerSlim to heavily shrink container images and automatically generate AppArmor or seccomp execution profiles.

#9 about 4 min

Inspecting internal image layers for container security forensics

Investigating suspicious changes and injected malicious files across individual container layers using the Dive utility.

#10 about 8 min

Implementing programmatic policy checks with Open Policy Agent

Using Conftest and the Rego language to programmatically test and enforce custom security safeguards on Dockerfiles.

#11 about 3 min

Enforcing custom organizational repository rules with Rego scripting

Preventing images from pulling from public registries by enforcing trusted internal software repository compliance checks.

#12 about 2 min

Integrating custom security checks into automated CI/CD workflows

Incorporating custom organizational policies and linting utilities natively into CI pipelines and Git pre-commit hooks.

Matching moments

2:16 min

A practical checklist for DevSecOps and container security

Mohammad-Ali A'râbi Mohammad-Ali A'râbi · WWC Europe 2026

6:33 min

Integrating SAST and container security into developer workflows

Mathias Tausig · LIVE

1:19 min

Securing Kubernetes workloads and containerized image layers

Aleksandr Kalikov · LIVE

1:28 min

Scaling organizational security with Docker AI governance layer

Manuel de la Peña Manuel de la Peña · WWC Europe 2026

1:34 min

Leveraging automated toolsets for hardened basic cluster configurations

Marc Nimmerrichter · WWC 2022

2:23 min

Securing container images in the build process

Rico Komenda Rico Komenda · WWC 2025

More from WeAreDevelopers LIVE

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz thumbnail
5:43
5 days ago

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz

Chris Heilmann, Daniel Cranney

WeAreDevelopers LIVE - Node and Package Security thumbnail
1:08:30
5 days ago

WeAreDevelopers LIVE - Node and Package Security

Chris Heilmann, Daniel Cranney, Zbyszek Tenerowicz

WeAreDevelopers LIVE - Streaming HTML thumbnail
1:10:26
12 days ago

WeAreDevelopers LIVE - Streaming HTML

Chris Heilmann, Daniel Cranney, Jad Joubran

WeAreDevelopers LIVE - CODE100 at WeAreDevelopers Europe thumbnail
1:02:34
19 days ago

WeAreDevelopers LIVE - CODE100 at WeAreDevelopers Europe

Chris Heilmann, Daniel Cranney, Justin Halsall, Werner Jeschko, Nicole Jeschko, Mirco Tomić

WeAreDevelopers LIVE - Web Performance in an AI World thumbnail
1:07:59
26 days ago

WeAreDevelopers LIVE - Web Performance in an AI World

Chris Heilmann, Daniel Cranney

FIFA Hack, Midjourney Does Ultrasounds, and Trampoline Traffic Lights - Nicole Jeschko and Werner Jeschko thumbnail
5:55
about 2 months ago

FIFA Hack, Midjourney Does Ultrasounds, and Trampoline Traffic Lights - Nicole Jeschko and Werner Jeschko

Chris Heilmann, Daniel Cranney

Upcoming sessions on this topic

Open session

World Congress 2026 North America

Stop Running Mystery Meat in Production

Jeroen van Erp

Technical Advocate @ SUSE

Jeroen van Erp
Open session

World Congress 2026 North America

rm -rf: Horror Stories From Unsandboxed AI Agents (and How Docker Fixes This)

Rishab Kumar

Staff Developer Evangelist @ Twilio

Rishab Kumar
Open session

World Congress 2026 North America

Practical Threat Modeling for Software Developers

Mudassir Syed

Lead Security Software Engineer

Mudassir Syed
Open session

World Congress 2026 North America

SecurePrompt: Building a Pre-Flight Security Layer for Agentic AI

Ravi Sastry Kadali

AI/ML Engineer at General Motors

Ravi Sastry Kadali
Open session

World Congress 2026 North America

On the Public Clock: Open-Source Defense When You're Not in the Club

Nicholas Muy

VP Engineering Platform and Security at Scrut.io

Nicholas Muy
Open session

World Congress 2026 North America

Red Teaming Your LLM App -- A Hands-On Threat Model You Can Reuse

Saloni Garg

Senior ML Engineer at Adobe

Saloni Garg

Related videos

Beyond SBOMs: The Future of Container Supply Chain Security thumbnail
30:38
WWC Europe 2026 • about 1 month ago

Beyond SBOMs: The Future of Container Supply Chain Security

Mohammad-Ali A'râbi

Reusing apps between teams and environments through Containers thumbnail
43:39
LIVE • over 5 years ago

Reusing apps between teams and environments through Containers

Adrian Kosmaczewski

Supply Chain Security and the Real World: Lessons From Incidents thumbnail
24:47
WWC 2025 • 12 months ago

Supply Chain Security and the Real World: Lessons From Incidents

Adrian Mouat

Kubernetes Security Best Practices thumbnail
23:08
WWC 2025 • 12 months ago

Kubernetes Security Best Practices

Rico Komenda

Turning Container security up to 11 with Capabilities thumbnail
28:47
WWC 2023 • almost 3 years ago

Turning Container security up to 11 with Capabilities

Mathias Tausig

Securing Your Web Application Pipeline From Intruders thumbnail
44:30
LIVE • almost 6 years ago

Securing Your Web Application Pipeline From Intruders

Milecia Mcgregor

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.