Lesson 3.1: Images and Dockerfiles
A container image is built in layers from a Dockerfile, and every mistake in that file ships with the application: an unpinned base image that changes under you, the whole source folder copied in (secrets included), a password written in a build step and kept forever in a layer, and a process that runs as root. In the lab you review the shop API's Dockerfile, find a secret that a later deletion couldn't remove because image history keeps every layer, confirm the container runs as root, and compare it with a hardened multi-stage Dockerfile.
17 min
You will learn to
- Explain images, layers and Dockerfiles
- Review a Dockerfile for common mistakes
- Find secrets in image history
- Check which user an image runs as
- Describe a hardened Dockerfile
Key terms
- Image and layer
- An image is a stack of read-only layers, one per build instruction; a container is a running instance of it.
- Dockerfile
- The recipe for building an image: FROM, COPY, RUN, USER, CMD…
- Base image and tag
- The image you build on, named by a tag (which can move) or a digest (which can't).
- Multi-stage build
- Building in one stage and copying only the result into a clean final image.
- .dockerignore
- A list of files never sent to the build, like .gitignore for images.
← Linux authentication and audit logs · All lessons · HMAC and message authentication →