auditing-container-image-build-hardening

name	auditing-container-image-build-hardening
description	Audit container image build definitions (Dockerfile, containerfile, and the compose or run config that sets runtime flags) for an image that ships over-privileged or carrying a secret, after multi-stage discards and deploy-time overrides are accounted for. Covers an image that runs as root, a secret baked into a layer, remote content pulled unpinned or unverified, a mutable or untagged base, an over-broad copy that pulls in local secrets and history, and a dangerous runtime request such as privileged mode or a sensitive host mount. Use when reviewing the image build plane, not the deploy-time security context or the cloud resource definition. The build definition is the source, the shipped image or run config is the sink, and privilege or a secret that survives into the final image is the bug.
license	MIT

Auditing container image build hardening: what survives into the shipped image

A secret used in a build stage that a multi-stage build discards is not in the shipped image, and a root Dockerfile deployed under a non-root security context does not run as root. So the bug here is not an instruction in isolation; it is what survives into the final image layer and the runtime request that ships with it. This audit reads the build definition and asks, per concern, whether the image that ships runs unprivileged, carries no secret in any layer, pulls only pinned and verified content, and requests no dangerous runtime privilege. The checklist competitors flag the instruction; the finding that survives is the one a later build stage or a deploy-time override does not neutralize. Stay on the image build plane, and hand deploy-time privilege to the Kubernetes skill and cloud resources to the infrastructure skill.

When to use

• You have a Dockerfile or containerfile, or a compose or run config that sets container runtime flags.
• An instruction sets the user, copies files, fetches remote content, pins a base, or requests a privilege.