Container Security: Securing Docker Base Images

Modern cloud architectures deploy applications inside micro-containers. However, if developer builds use unpatched base images, they import hundreds of known vulnerabilities (CVEs).

---

Auditing with Trivy

We use Trivy, a fast, open-source vulnerability scanner for containers, to trace OS library exposures in the CI/CD pipeline.

# Run Trivy scan on docker image
trivy image trustlayerlabs/web-app:latest

If bloated base images like node:latest are used, scanners can return over 800 vulnerabilities, ranging from outdated OpenSSL versions to system libs risks.

---

Hardening Dockerfiles

1. Use Minimal Base Images: Adopt distroless or Alpine base images.

# Hardened minimal Node setup
FROM node:20-alpine
WORKDIR /app
COPY . .
RUN npm ci --only=production
USER node
CMD ["node", "server.js"]

2. Execute under Non-Root User contexts: Configure the USER directive to avoid container breakout risks.