> Markdown version of [/videos/109-a-practical-guide-to-writing-secure-dockerfiles](https://www.wearedevelopers.com/videos/109-a-practical-guide-to-writing-secure-dockerfiles). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# A practical guide to writing secure Dockerfiles

Hardcoded credentials and bloated base images are quiet supply chain killers. Lock down your Dockerfiles using minimal images, secure credential mounting, and dynamic OPA policies.

- **Speakers:** Madhu Akula
- **Event:** WeAreDevelopers LIVE
- **Published:** February 3, 2021
- **Duration:** 42:25
- **URL:** https://www.wearedevelopers.com/videos/109-a-practical-guide-to-writing-secure-dockerfiles

## Summary

Dockerfiles serve as the foundational blueprints for containerized applications, effectively treating infrastructure as code. Because they are often version-controlled alongside application logic, insecure instructions—such as hardcoded credentials or bloated base images—introduce significant supply chain security risks. Establishing a secure baseline requires shifting away from theoretical advice toward practical, programmatic validation embedded directly into developer workflows and CI/CD pipelines.

Securing container images begins with foundational operational practices: utilizing minimal base images like Alpine, enforcing specific version tags instead of latest, and implementing multi-stage builds to strip out unnecessary build dependencies from the final runtime environment. Developers must avoid embedding secrets directly into image layers; instead, leveraging BuildKit allows for secure credential mounting and SSH socket forwarding during the build process. Integrating tools like Hadolint and Dockle provides automated linting against CIS benchmarks, while Dive helps visually inspect individual image layers for unintended file inclusion. Additionally, Docker Slim optimizes target image sizes while automatically generating strict Seccomp and AppArmor profiles to restrict over-privileged containers.

To scale these practices across engineering teams, organizations can enforce customized security boundaries using the Open Policy Agent (OPA) and Rego policies via Conftest. While standard linters catch generalized issues, custom OPA rules dynamically evaluate structured Dockerfile data to govern specific internal requirements. This approach can categorically reject builds that introduce vulnerabilities via ADD instructions or completely restrict base image pulls to trusted, private registries. Embedding these policy checks into local IDEs and automated pre-commit workflows ensures continuous compliance, minimizing runtime vulnerabilities and fortifying the complete security lifecycle.

**Keywords:** dockerfile security, container supply chain, infrastructure as code, multi-stage builds, docker buildkit, open policy agent, rego policies, hadolint, dockle, docker slim, seccomp profiles, apparmor compliance, image layer inspection, cis benchmarks, ci/cd automation, secret management

## Chapters

1. **Introduction to Docker and container deployment foundations** (00:16) — How Dockerfiles script the deployment environment to package scalable and portable applications.
1. **Understanding Dockerfile structure and cloud environment security risks** (04:41) — How hardcoded secrets and misconfigured instructions in Dockerfiles compromise entire cloud environments.
1. **Docker official best practices for container image architecture** (07:41) — Implementing minimal base images, build caching, and multistage structures to reduce container vulnerabilities.
1. **Applying tactical security configurations to Docker container layers** (12:23) — Applying specific package manager flags, non-root users, and absolute image tags to minimize runtime exploits.
1. **Passing credentials securely with Docker BuildKit ephemeral mounts** (16:26) — Mounting AWS credentials and SSH sockets securely during image builds without exposing them in container history.
1. **Automating security best practices with Dockerfile static linters** (20:53) — Utilizing static linting tools like Hadolint to automatically detect unoptimized patterns such as improper file insertions.
1. **Auditing container configurations against CIS benchmark security standards** (23:32) — Validating Docker images against CIS benchmarks to catch root user privileges and exposed environmental secrets.
1. **Minimizing image size and generating automated security profiles** (25:48) — Using DockerSlim to heavily shrink container images and automatically generate AppArmor or seccomp execution profiles.
1. **Inspecting internal image layers for container security forensics** (27:28) — Investigating suspicious changes and injected malicious files across individual container layers using the Dive utility.
1. **Implementing programmatic policy checks with Open Policy Agent** (30:46) — Using Conftest and the Rego language to programmatically test and enforce custom security safeguards on Dockerfiles.
1. **Enforcing custom organizational repository rules with Rego scripting** (37:54) — Preventing images from pulling from public registries by enforcing trusted internal software repository compliance checks.
1. **Integrating custom security checks into automated CI/CD workflows** (40:42) — Incorporating custom organizational policies and linting utilities natively into CI pipelines and Git pre-commit hooks.

## Related Moments

- [A practical checklist for DevSecOps and container security](https://www.wearedevelopers.com/videos/100235-beyond-sboms-the-future-of-container-supply-chain-security) (from "Beyond SBOMs: The Future of Container Supply Chain Security")
- [Integrating SAST and container security into developer workflows](https://www.wearedevelopers.com/videos/351-maturity-assessment-for-technicians-or-how-i-learned-to-love-owasp-samm) (from "Maturity assessment for technicians or how I learned to love OWASP SAMM")
- [Securing Kubernetes workloads and containerized image layers](https://www.wearedevelopers.com/videos/242-microservices-how-to-get-started-with-spring-boot-and-kubernetes) (from "Microservices: how to get started with Spring Boot and Kubernetes")
- [Scaling organizational security with Docker AI governance layer](https://www.wearedevelopers.com/videos/100350-yolo-developer-workflows-with-a-coding-agent-in-a-box) (from "YOLO Developer Workflows with a Coding Agent in a Box")
- [Leveraging automated toolsets for hardened basic cluster configurations](https://www.wearedevelopers.com/videos/412-kubernetes-security-challenge-and-opportunity) (from "Kubernetes Security - Challenge and Opportunity")
- [Securing container images in the build process](https://www.wearedevelopers.com/videos/1411-kubernetes-security-best-practices) (from "Kubernetes Security Best Practices")

## Related Articles

- [Building AI Solutions with Rust and Docker](https://www.wearedevelopers.com/magazine/494-building-ai-solutions-with-rust-and-docker)
- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)
- [The Overflow: 5 Security and Privacy Tools for Developers](https://www.wearedevelopers.com/magazine/710-the-overflow-5-security-and-privacy-tools-for-developers)
- [Now is the time for industrialized software development](https://www.wearedevelopers.com/magazine/601-now-is-the-time-for-industrialized-software-development)

## Related Jobs

- [Staff Developer Advocate, GitHub Security Lab](https://www.wearedevelopers.com/jobs/ext/1921051-staff-developer-advocate-github-security-lab) at **GitHub**
- [Devops Engineer](https://www.wearedevelopers.com/jobs/ext/1940926-devops-engineer) at **Bitpanda**
- [Lead Cloud DevSecOps Engineer - Kubernetes](https://www.wearedevelopers.com/jobs/ext/1659167-lead-cloud-devsecops-engineer-kubernetes) at **BWI GmbH**
- [Engineer, Offensive Security Organization](https://www.wearedevelopers.com/jobs/ext/1992296-engineer-offensive-security-organization) at **Twilio**
- [Cloud Foundations Team](https://www.wearedevelopers.com/jobs/ext/1483289-cloud-foundations-team) at **GitHub**
- [Principal Software Engineer, Identity](https://www.wearedevelopers.com/jobs/ext/1469181-principal-software-engineer-identity) at **GitHub**