5 Security Best Practices For Production Ready Containers
summary
Shows concrete results: starting image with ~937 MB and >1,000 vulnerabilities shrinks to ~25 MB with zero known vulns by combining Docker Slim minification, Slim AI scanning and SBoM checks. Uses Python images across Debian/Alpine/Ubuntu, proves Ubuntu can be lower-risk than Debian 11, warns Alpine can break Python, and demonstrates build hygiene: pin base tags, run as nobody user, avoid installing recommended packages, and rebuild nightly with --pull --no-cache to ensure updated system packages.
AI-written summary · about
chapters (13)
- 0:00Start
- 2:43A Better Dockerfile
- 3:16USER nobody
- 4:07Pinned "distro" & language versions
- 5:25Apply updates
- 6:37Layer caching
- 8:25Container scanning
- 9:26Container analysis
- 10:06A "slim" base image
- 10:53Fewer packages
- 17:22How does DockerSlim work?
- 19:21App by slimmed image size
- 20:51Slimmed App by vulnerability report
related talks
29m5 Best Security Practices for your Production-Ready Containers
40m"Willy Wonka and the Secure Container Factory"
35mSecuring Containers by Breaking In
35mDocker Security
20mCreating Production Ready Containers: What Devs Need to Know to Secure Their Containers
25m0 to production-ready: a best-practices process for Docker packaging
30mMaster the Container Security Model with
29mZero to production-ready: a best-practices process for Docker packaging