ring:hardening-dockerfiles

Docker Security (Health Score Grade A)

When to use

• Creating a new Dockerfile
• Auditing an existing Dockerfile for security
• Preparing images for Docker Hub publication
• Docker Hub health score is below grade A

Skip when

• Project has no Dockerfile and none is being created
• Changes are application-code only with no Docker modifications
• Using pre-built images without custom Dockerfile

Related

Complementary: ring:implementing-tasks, ring:creating-helm-charts

General Dockerfile patterns: dev-team/docs/standards/devops.md#containers. This skill focuses on Docker Hub Health Score compliance.

Health Score Policies

#	Policy	Weight	Compliance
1	Default non-root user	Required	USER directive with non-root user
2	No fixable critical/high CVEs	Required	Distroless or Alpine, multi-stage
3	No high-profile vulnerabilities (CISA KEV)	Required	Up-to-date base images
4	No AGPL v3 licenses	Required	Audit dependencies
5	Supply chain attestations (SBOM + provenance)	Required	Pipeline config
6	No outdated base images	Optional	Only for Docker Hub hosted images
7	No unapproved base images	Optional	Only for Docker Hub hosted images

Policies 6-7 are not evaluated when using non-Docker Hub base images (gcr.io/distroless, etc.).

Policy Implementation

Policy 1 — Non-Root User

# Alpine
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
USER appuser

# Debian/Ubuntu
RUN groupadd -r appgroup && useradd -r -g appgroup appuser
USER appuser

# Distroless (pre-existing user)
USER nonroot:nonroot

USER root does NOT satisfy this policy.

Policies 2 & 3 — Minimal Attack Surface

# Go (statically compiled) — ~0 CVEs
FROM gcr.io/distroless/static-debian12

# Go (CGO) or general
FROM gcr.io/distroless/base-debian12

# Node.js
FROM node:22-alpine

# Multi-stage mandatory
FROM golang:1.23-alpine AS builder
# ... build ...
FROM gcr.io/distroless/static-debian12
COPY --from=builder /app/binary /app/binary

Policy 4 — No AGPL v3

trivy fs --scanners license --severity CRITICAL .

Replace any AGPL-3.0 dependency.

Policy 5 — Supply Chain Attestations (Pipeline)

# build-push-action config
sbom: generator=docker/scout-sbom-indexer:latest
provenance: mode=max

Not a Dockerfile concern — verify CI/CD includes both parameters.

Dockerfile Templates

Go Service

FROM golang:1.23-alpine AS builder
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o app ./cmd/...

FROM gcr.io/distroless/static-debian12
COPY --from=builder /app/app /app/app
EXPOSE 3000
USER nonroot:nonroot
ENTRYPOINT ["/app/app"]

TypeScript/Node.js

FROM node:22-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
RUN npm run build

FROM node:22-alpine
WORKDIR /app
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
EXPOSE 3000
USER appuser
CMD ["node", "dist/index.js"]

Audit Checklist

CRITICAL (blocks grade A):
[ ] USER directive with non-root user
[ ] Multi-stage build (no build tools in final)
[ ] Minimal base image (distroless/alpine)
[ ] No secrets in image layers

HIGH (CVE risk):
[ ] Base image is up to date
[ ] Package versions pinned
[ ] No dev dependencies in final stage

MEDIUM:
[ ] .dockerignore excludes .git, node_modules, test files
[ ] COPY used (not ADD)
[ ] Cache layers ordered: deps before source

SUPPLY CHAIN (pipeline):
[ ] sbom: parameter in build-push-action
[ ] provenance: mode=max

Report Template

## Health Score Compliance

| Policy | Status | Details |
|--------|--------|---------|
| Default non-root user | PASS/FAIL | USER {user} at line {N} |
| No fixable CVEs | PASS/RISK | Base: {image} |
| No KEV vulnerabilities | PASS/RISK | Base image {status} |
| No AGPL v3 licenses | PASS/RISK | {N} deps audited |
| Supply chain attestations | PASS/MISSING | sbom: {yes/no}, provenance: {yes/no} |

**Grade A: {ACHIEVED / NOT ACHIEVED}**

## Actions Taken
| File | Action | Changes |