Python Containers: Best Practices
summary
Recommends Yan Smith’s Dockerfiles, uses multi-stage builds and Trivy scans, and demonstrates that running an OS update during image build fixes 20+ vulnerabilities in a week; creates a non-root app user and suggests podman rootless for safer local runs; prefers Python slim or Alpine images depending on C wheel needs and advises precompiling bytecode rather than setting PYTHONDONTWRITEBYTECODE; favors prefer COPY over ADD for transparency and faster, smaller, safer images.
AI-written summary · about
chapters (9)
- 0:00Introduction to containers
- 4:01Why containers are verbose
- 5:26Principle of least privilege
- 8:17Rootless containers with Podman
- 10:49Smaller containers are safer
- 13:00Choosing base images
- 16:11Updating base images for security
- 19:19Miscellaneous tips
- 22:15Q&A session
related talks
29mZero to production-ready: a best-practices process for Docker packaging
40mDocker and Python: making them play nicely and securely for Data Science and ML
25m0 to production-ready: a best-practices process for Docker packaging
40m"Willy Wonka and the Secure Container Factory"
43mZero to production ready: a best practices process for Docker packaging
38mSo. Many. Vulnerabilities. Why are containers such a mess...
30mContainers Without the Magic
23mCleaning Up Your Python Environment Superfund Site