How do you harden a Docker image and container at build and run time?

Question

Accepted Answer

I harden at both build time and run time. At build time, first, do not run as root, which is the default, meaning UID 0 inside the container. I create a dedicated non-root user, say UID 10001, and switch to it with USER, so a container compromise does not immediately hand over root. Second, keep secrets out of the image entirely. A secret put in an ARG, an ENV, or a copied file stays in the image history even if a later layer deletes it, and anyone who pulls the image can recover it with 1 docker history command, so I use BuildKit build secrets with --mount=type=secret for build-time credentials and inject runtime secrets through the platform, never baked in. Third, a minimal base, slim or distroless, which can take an image from around 1 GB down to under 100 MB and cuts the attack surface with it, pinned by digest for reproducibility, plus image scanning in CI to catch known CVEs. At run time I add the OS-level controls: a read-only root filesystem so the container cannot be modified, dropping Linux capabilities with --cap-drop ALL and adding back only the 1 or 2 that are genuinely needed, setting no-new-privileges to block privilege escalation, and never using --privileged unless there is a hard requirement. The mindset is least privilege end to end, and assume the container could be compromised, so limit what that buys an attacker.

Answer

Why is putting a secret in an ENV or ARG dangerous even if you delete it later?

Image layers are immutable and additive: the secret remains in the layer history and can be extracted, even if a later instruction removes it. Use BuildKit secret mounts or runtime injection so it never lands in a layer.

Answer

What does running as non-root actually protect against?

It limits the blast radius of a container escape or app compromise: an attacker starts unprivileged, so combined with dropped capabilities and no-new-privileges it is much harder to break out to the host.

How do you harden a Docker image and container at build and run time?

How do you harden a Docker image and container at build and run time?

The follow-ups they ask next

What the interviewer is listening for

What sinks the answer

If you genuinely do not know

Keep going with docker

Knowing the answer is not the same as recalling it under pressure