Package · Container build & runtime
Docker
Docker provides the Dockerfile build format, BuildKit and a runtime for OCI containers. It is the packaging step whose choices — base image, user, layers — decide most of the vulnerability surface.
On this page
What it does
Builds images from Dockerfiles with BuildKit (multi-stage builds, cache mounts, secrets mounts) and runs containers locally.
Where it fits
Package stage. Security decisions made here — minimal base images, non-root users, pinned digests, no secrets in layers — determine how much the Secure stage will find.
Quick start
docker build --pull -t app:dev .
docker run --rm --read-only --cap-drop ALL --user 10001 app:dev
docker buildx build --sbom=true --provenance=true -t registry.example.com/app:1.2.3 --push .Common pitfalls
- Mounting
/var/run/docker.sockinto CI agents grants root on the host; prefer Kaniko or rootless BuildKit. --build-argvalues are recorded in image history; use--mount=type=secretfor build-time credentials.- Mutable tags (
latest) make scans unreproducible; deploy by digest.
Hands-on labs using Docker
Secure Docker Images with Trivy
Build a deliberately weak image, scan it with Trivy, and rebuild it until the gate for fixable HIGH and CRITICAL findings passes: current base, non-root user, patched packages, no pip in the runtime image.
Generate an SBOM with Syft and Scan It with Grype
Produce CycloneDX and SPDX bills of materials for a container image without a Docker socket, scan the SBOM with Grype, gate on fixable findings only, and see why the SBOM is worth keeping after the release.
Articles about Docker
Cloud Network Security Boundaries: Exposure, Tiers and Default Deny
Deciding what a cloud workload exposes: public and private subnets, security groups that reference each other instead of address ranges, egress control, TLS and DNS, proven with connection tests on a three-tier layout.
Secrets and Configuration Security: Images, Kubernetes, Vault and Rotation
The secrets lifecycle for a cloud workload: credentials recovered from image history and deleted layers, a build that leaves nothing behind, Secrets in etcd before and after encryption at rest, rotation, and Vault TTLs.
Building Minimal Container Images with Multi-Stage Builds
Build the same Go service as a single-stage image and as a multi-stage image on a distroless base, then compare size, package count, scanner findings and the user it runs as.
Container Image Scanning with Trivy
How Trivy finds OS and application vulnerabilities, secrets and misconfigurations in container images, how to make the results actionable, and how to wire it into CI without slowing builds down.
Building a Secure CI/CD Pipeline with Jenkins
A declarative Jenkins pipeline with secrets scanning, SAST, image scanning and least-privilege credential handling — and the agent, plugin and Docker decisions that keep it that way.