Secure container images: minimal bases, Hadolint, Trivy
You build small, rootless images without known vulnerabilities, check Dockerfiles and images automatically and distribute signed images safely from a local registry.
Level 301 · 18 lessons · 15 practice labs
Lessons
The base image
- Choosing a base: full, slim, alpine, distroless
- Pinning by digest and keeping it current
- Debugging a distroless image
- Short task: halve an image’s size and vulnerability count
The Dockerfile
- Multi-stage builds: leaving build tools out
- Checking Dockerfiles with Hadolint
- File ownership, permissions and a read-only app directory
- Health checks and handling signals properly
- Short task: write a Dockerfile with no Hadolint warnings
Image scanning
- OS and language packages with Trivy
- Best-practice checks with Dockle
- Scanning images for secrets and misconfigurations
- Ignoring accepted vulnerabilities with documentation
- Short task: write a scan step that rejects images with critical vulnerabilities
Distribution
- A local registry and access control
- Signing images and verifying on pull
- Regular rebuilds: catching base image updates
- Capstone: a production-ready secure image for a Python service
Practice labs
- Compare four base image types by size and contents: Tabulate the size of full, slim, alpine and distroless images and whether each contains a shell.
- Pin the base image by digest: Convert a base image pulled by tag to a digest and document how it will be kept current.
- Halve an image’s size and vulnerability count: Change the base image, remove unneeded packages, show how to debug the distroless image and present before and after measurements.
- Check a Dockerfile with Hadolint: Run the check and write the rule numbers and meaning of the warnings raised.
- Leave build tools out of the image with a multi-stage build: Split a single-stage Dockerfile into build and runtime stages and show the final image holds no compiler.
- Write a Dockerfile with no Hadolint warnings and a read-only app directory: Set ownership and permissions so the app user cannot write to its code, add a health check and prove the stop signal is handled cleanly.
- Report OS and language packages separately with Trivy: Run the scan and separate vulnerability counts from the OS and from application dependencies.
- Run best-practice checks with Dockle and fix the findings: Fix the root user, missing health check and secret file left in the image, then check again.
- Write a scan step that rejects images with critical vulnerabilities: Write the scan step so its exit code stops the pipeline, and add an accepted flaw to the ignore file with reason and expiry.
- Push an image to the local registry and list its tags: Tag and push the image and fetch the tag list from the registry API.
- Add access control to the registry: Disable anonymous push, enable authentication and test separate accounts for read and write.
- Sign the image, verify on pull and set up regular rebuilds: Verify the signed image at deploy, write a scheduled job that rebuilds when the base image updates and show the old digest changes.
- List the image requirements of a Python service: Extract the runtime dependencies, port, user and writable paths.
- Build a multi-stage slim image for a Python service: Install dependencies in the build stage, copy only what is needed into the runtime stage and run as an unprivileged user.
- Scan, sign and publish a production-ready secure image: Sign an image that passes Hadolint, Trivy and Dockle checks, push it to the registry and report before and after measurements.
About this course
You build small, rootless images without known vulnerabilities, check Dockerfiles and images automatically and distribute signed images safely from a local registry.
What you will learn
- The base image
- The Dockerfile
- Image scanning
- Distribution
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.