#HEADSUP 07 – Build your Dockerfile using best practices

Security is a critical concern in any computing environment. When creating Dockerfiles, it is important to keep in mind that security is a fundamental aspect that must be taken into account from the very beginning. The Dockerfile is the foundation for creating container images. Therefore, I present here some important best practices that should be considered when creating or updating your images.

Define a user in your Dockerfile:

Docker runs containers as root by default, which can pose a security risk, allowing an attacker to exploit vulnerabilities and gain access to the host.

To mitigate this risk, it is highly recommended to run containers as a less privileged user whenever possible, using the “USER” instruction in the Dockerfile.

FROM python:3.9-slim

# Cria grupo e usuário de sistema sem senha.

RUN groupadd -r appuser && useradd -r -g appuser appuser

WORKDIR /app

COPY myapp /app

RUN pip install --no-cache-dir -r requirements.txt

# Define as permissões para o diretório /app

RUN chown -R appuser:appuser /app

# Define o usuário padrão para o contêiner

USER appuser

CMD [ "python", "./app.py" ]

Use trusted images:

When creating a Dockerfile, it is important to choose official images from trusted sources as the base for your own images. Opting for minimal images with only the necessary tools and libraries ensures a lighter, safer, and more efficient image. 

This way, you can maintain control over the environment where your application will run, avoid security issues and future conflicts, and ensure that all dependencies are present in the image.

# Imagem Base

FROM alpine:3.14

RUN apk add --no-cache python3 py3-pip

RUN addgroup -S appuser && adduser -S appuser -G appuser

WORKDIR /app

COPY app /app

RUN pip install --no-cache-dir -r requirements.txt

RUN chown -R appuser:appuser /app

USER appuser

CMD [ "python", "./app.py" ]

Avoid sensitive data leakage:

It is crucial to protect sensitive data, such as passwords, private keys, and tokens, avoiding their direct inclusion in the Dockerfile. Use secure resources to store them, like Kubernetes secrets or vaults such as hashicorp vault, aws secrets Manager, etc. 

Additionally, to prevent the accidental inclusion of sensitive files in the image, use the “.dockerignore” file to specify files and directories that should be excluded during the image build process.

Build images using Multi-stage:

A well-designed multi-stage approach includes only the binaries and the minimal dependencies required in the final image, reducing build time and potentially shrinking the attack and vulnerability surface, as well as significantly reducing the size of the final image.

# Stage 1 - Build da aplicação

FROM node:14-alpine AS build

WORKDIR /app

COPY package*.json ./

RUN npm install –production

COPY app /app

RUN npm run build

# Stage 2 - Cópia dos arquivos de build e execução da aplicação

FROM node:14-alpine

WORKDIR /app

COPY --from=build /app/dist /app

COPY package*.json ./

RUN npm install –only=production

USER node

EXPOSE 3000

CMD ["npm", "start"]

Use a Linter to check for errors:

Using tools like hadolint helps to identify potential errors and ensures that your Dockerfile is following recommended best practices, making it possible to fix issues before or during the process of building your image.

FROM alpine:3.14

RUN apk add --no-cache python3 py3-pip

RUN addgroup -S appuser && adduser -S appuser -G appuser

WORKDIR /app

COPY app /app

RUN pip install --no-cache-dir -r requirements.txt

RUN chown -R appuser:appuser /app

USER appuser

CMD [ "python", "./app.py" ]

Using scanning tools:

Scanning tools, like trivy, help identify vulnerabilities in images and provide detailed information about the issues found. By using them, you can identify and patch vulnerabilities before deploying your application into production, ensuring greater security and reliability.

Conclusion:

Creating a Dockerfile using best practices allows you to mitigate security risks, reduce vulnerabilities, and ensure the reliability of the application. Therefore, investing in security from the very beginning of the image construction process is the best way to prevent future security issues.