Container Image Hardening

Review and fix Dockerfiles and images for production safety.

Dockerfile Review Checklist

• Base image: official, specific tag or digest, minimal variant (alpine, distroless, slim); never latest
• Multi-stage builds: build toolchains (compilers, package managers) excluded from final image
• Non-root user: USER directive with a dedicated UID; no sudo in image
• No secrets: no ENV with credentials, no COPY .env, no secrets baked into layers (they persist even if deleted later)
• Pinned dependencies: lockfiles used (npm ci, pip install -r requirements.txt with hashes)
• Healthchecks defined; ENTRYPOINT over CMD for enforced init
• Layer hygiene: combine apt operations and clean lists in one layer; .dockerignore covers .git, build artifacts

Scan and Gate