Container Security Scanner

Running as root inside a container is dangerous because if an attacker escapes the container (via a kernel vulnerability or misconfiguration), they gain root on the host. The principle of least privilege requires containers run as an unprivileged user. Use USER directive in Dockerfile: 'RUN addgroup -S appgroup && adduser -S appuser -G appgroup' then 'USER appuser'. Kubernetes SecurityContext can also enforce non-root at the pod level with runAsNonRoot: true.

Minimal base images reduce attack surface by containing fewer packages that could have vulnerabilities. Best options: scratch (empty, for statically compiled Go/Rust binaries), distroless (Google's minimal images without shell or package manager), Alpine (musl libc + BusyBox, ~5MB), Chainguard images (hardened, continuously patched). Avoid full debian/ubuntu/centos for production — they include compilers, package managers, and hundreds of packages you don't need.

Multi-stage builds separate the build environment (with compilers, dev dependencies, secrets needed for fetching packages) from the final runtime image. Build secrets, SSH keys, and dev tools never appear in the final image layers. The final image only contains compiled artifacts. This dramatically reduces image size and attack surface — a typical Go app goes from 800MB to 10MB, and a Node.js app from 400MB to 50MB with multi-stage builds.

API keys, database passwords, private keys, tokens, and any credentials should never be in ENV (they're visible in docker inspect and image metadata) or ARG (visible in build history). Use Docker secrets (--secret flag) for build-time secrets, or runtime secrets injection via environment from your orchestration layer (Kubernetes Secrets, AWS Secrets Manager, Vault). Scan images with tools like Trivy, docker scan, or Hadolint to detect hardcoded secrets.

The HEALTHCHECK instruction tells Docker how to test if a container is still working correctly. Without it, Docker only tracks if the process is running — not if it's actually healthy (e.g., the app might be deadlocked or returning errors). A health check enables orchestrators (Kubernetes, Swarm) to restart unhealthy containers and route traffic away from them. Example: 'HEALTHCHECK --interval=30s --timeout=3s --retries=3 CMD wget -qO- http://localhost:8080/health || exit 1'