WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
WeAreDevelopers LIVE • Feb 3, 2021

A practical guide to writing secure Dockerfiles

Madhu Akula

Hardcoded credentials and bloated base images are quiet supply chain killers. Lock down your Dockerfiles using minimal images, secure credential mounting, and dynamic OPA policies.

Pause
Mute Enter Fullscreen
#1 about 5 min

Introduction to Docker and container deployment foundations

How Dockerfiles script the deployment environment to package scalable and portable applications.

#2 about 3 min

Understanding Dockerfile structure and cloud environment security risks

How hardcoded secrets and misconfigured instructions in Dockerfiles compromise entire cloud environments.

#3 about 5 min

Docker official best practices for container image architecture

Implementing minimal base images, build caching, and multistage structures to reduce container vulnerabilities.

#4 about 5 min

Applying tactical security configurations to Docker container layers

Applying specific package manager flags, non-root users, and absolute image tags to minimize runtime exploits.

#5 about 5 min

Passing credentials securely with Docker BuildKit ephemeral mounts

Mounting AWS credentials and SSH sockets securely during image builds without exposing them in container history.

#6 about 3 min

Automating security best practices with Dockerfile static linters

Utilizing static linting tools like Hadolint to automatically detect unoptimized patterns such as improper file insertions.

#7 about 3 min

Auditing container configurations against CIS benchmark security standards

Validating Docker images against CIS benchmarks to catch root user privileges and exposed environmental secrets.

#8 about 2 min

Minimizing image size and generating automated security profiles

Using DockerSlim to heavily shrink container images and automatically generate AppArmor or seccomp execution profiles.

#9 about 4 min

Inspecting internal image layers for container security forensics

Investigating suspicious changes and injected malicious files across individual container layers using the Dive utility.

#10 about 8 min

Implementing programmatic policy checks with Open Policy Agent

Using Conftest and the Rego language to programmatically test and enforce custom security safeguards on Dockerfiles.

#11 about 3 min

Enforcing custom organizational repository rules with Rego scripting

Preventing images from pulling from public registries by enforcing trusted internal software repository compliance checks.

#12 about 2 min

Integrating custom security checks into automated CI/CD workflows

Incorporating custom organizational policies and linting utilities natively into CI pipelines and Git pre-commit hooks.

Matching moments

2:16 min

A practical checklist for DevSecOps and container security

Mohammad-Ali A'râbi Mohammad-Ali A'râbi · World Congress 2026 Europe

6:33 min

Integrating SAST and container security into developer workflows

Mathias Tausig · LIVE

1:19 min

Securing Kubernetes workloads and containerized image layers

Aleksandr Kalikov · LIVE

1:28 min

Scaling organizational security with Docker AI governance layer

Manuel de la Peña Manuel de la Peña · World Congress 2026 Europe

1:34 min

Leveraging automated toolsets for hardened basic cluster configurations

Marc Nimmerrichter · World Congress 2022

2:23 min

Securing container images in the build process

Rico Komenda Rico Komenda · World Congress 2025

More from WeAreDevelopers LIVE

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude thumbnail
6:16
9 days ago

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude

Chris Heilmann, Daniel Cranney

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas thumbnail
5:46
14 days ago

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas

Chris Heilmann, Daniel Cranney, Marc Plogas

WeAreDevelopers - Of Agents and Robots thumbnail
1:04:42
14 days ago

WeAreDevelopers - Of Agents and Robots

Chris Heilmann, Daniel Cranney, Marc Plogas

WeAreDevelopers LIVE - How DevRel Makes Tech More Human thumbnail
48:06
21 days ago

WeAreDevelopers LIVE - How DevRel Makes Tech More Human

Chris Heilmann, Daniel Cranney

Fake or News: Smart Glasses in Court, Medical Advice Watches & Mushroom Electonics - Jason Torres thumbnail
7:41
22 days ago

Fake or News: Smart Glasses in Court, Medical Advice Watches & Mushroom Electonics - Jason Torres

Chris Heilmann, Daniel Cranney

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz thumbnail
5:43
about 1 month ago

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz

Chris Heilmann, Daniel Cranney

Upcoming sessions on this topic

Open session

World Congress 2026 North America

September 23, 2026 · 15:45–17:45

Stage 10

Securing the Agentic Stack: Docker Hardened Images and Supply Chain Security

Ajeet Raina

Developer Advocate at Docker

Ajeet Raina
Open session

World Congress 2026 North America

September 25, 2026 · 09:40–10:10

Stage 4

Your registry can't stop a valid login. What happens then?

Khushboo Verma

Systems Engineer at Cloudflare

Khushboo Verma
Open session

World Congress 2026 North America

September 25, 2026 · 12:30–14:30

Stage 11

Docker sandboxes: protect your secrets, tokens, and personal data from AI agent mistakes

Kristiyan Velkov

Front-End Advocate | Speaker | AI & DevOps | Docker Captain | Cursor Ambassador | DevReal | Tech Blogger | Book Author

Kristiyan Velkov
Open session

World Congress 2026 North America

September 24, 2026 · 11:40–12:10

Stage 3

Stop Running Mystery Meat in Production

Jeroen van Erp

Technical Advocate @ SUSE

Jeroen van Erp
Open session

World Congress 2026 North America

September 23, 2026 · 15:45–17:45

Stage 8

Docker's Agentic Platform: Sandboxes, MCP, and the Infrastructure of Autonomous Development

Oleg Å elajev

AI and Developer relations at Docker

Oleg Å elajev
Open session

World Congress 2026 North America

September 23, 2026 · 11:00–11:30

Stage 1

Docker does that? Five Docker capabilities you did not know about

Michael Irwin

Principal Engineer, Developer Success

Michael Irwin

Related videos

Beyond SBOMs: The Future of Container Supply Chain Security thumbnail
30:38
World Congress 2026 Europe • 2 months ago

Beyond SBOMs: The Future of Container Supply Chain Security

Mohammad-Ali A'râbi

Reusing apps between teams and environments through Containers thumbnail
43:39
LIVE • over 5 years ago

Reusing apps between teams and environments through Containers

Adrian Kosmaczewski

Supply Chain Security and the Real World: Lessons From Incidents thumbnail
24:47
World Congress 2025 • about 1 year ago

Supply Chain Security and the Real World: Lessons From Incidents

Adrian Mouat

Kubernetes Security Best Practices thumbnail
23:08
World Congress 2025 • about 1 year ago

Kubernetes Security Best Practices

Rico Komenda

Turning Container security up to 11 with Capabilities thumbnail
28:47
World Congress 2023 • almost 3 years ago

Turning Container security up to 11 with Capabilities

Mathias Tausig

Securing Your Web Application Pipeline From Intruders thumbnail
44:30
LIVE • almost 6 years ago

Securing Your Web Application Pipeline From Intruders

Milecia Mcgregor

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.