Slimming and securing images

Small is also safer

Containers run as root by default, which means a process escaping the container escapes as root. Creating an unprivileged user and switching to it is a one-line change with a large payoff.

A secret passed as a build argument is baked into the image history and remains readable to anyone who pulls it, even if a later layer deletes the file. Use build secrets or inject at runtime.

Scan images in the pipeline and rebuild regularly. Most vulnerabilities in your image come from the base, and they appear without you changing a line of code.