Container Image

Container images are immutable templates used to create container instances. They consist of layered filesystems built from a base image.

Image components

• Base image: Operating system layer (Alpine, Ubuntu, Distroless).
• Dependencies: Libraries, frameworks, runtime environments.
• Application code: Your compiled or interpreted application.
• Configuration: Environment variables, config files.
• Metadata: Labels, exposed ports, entrypoint commands.

Security considerations

• Base image selection: Minimal images reduce attack surface.
• Vulnerability scanning: Scan images for known CVEs.
• Image signing: Verify image integrity and provenance.
• Secret management: Never bake secrets into images.
• Non-root users: Run processes as non-privileged users.

Best practices

1. Use specific version tags, not latest.
2. Choose minimal base images (Alpine, Distroless).
3. Multi-stage builds to exclude build tools.
4. Scan images in CI/CD before pushing to registry.
5. Implement image lifecycle policies (expire old images).
6. Sign images with Cosign or Notary.

Common vulnerabilities

• Outdated base images with unpatched OS packages.
• Vulnerable application dependencies.
• Exposed secrets in image layers.
• Running as root user.
• Unnecessary packages increasing attack surface.