A Practical Guide to Container Image Hardening

Platform Security

Smaller attack surfaces, reproducible builds, and runtime controls — a walkthrough of the hardening steps that make container images safer in production.

A Practical Guide to Container Image Hardening

Hardened container images reduce attack surface, improve reproducibility, and make runtime security controls easier to reason about. This guide covers the four steps that give the biggest return.

PodWarden security shield illustration

The PodWarden security model treats the container image as the first line of defence.

1. Start From a Minimal Base

Prefer distroless or scratch-based images over general-purpose distributions. Every package you do not include is a CVE you cannot be vulnerable to.

FROM gcr.io/distroless/nodejs22-debian12
COPY --from=build /app/dist /app
CMD ["/app/server.js"]

2. Pin Every Dependency

Use digest pinning (@sha256:...) rather than mutable tags. A mutable tag can silently change between builds; a digest is immutable.

3. Run as a Non-Root User

USER nonroot:nonroot

Kubernetes admission policies (PodSecurity Admission or OPA Gatekeeper) can enforce this at the cluster level so non-compliant images are rejected at deploy time.

4. Enable Read-Only Root Filesystem

securityContext:
  readOnlyRootFilesystem: true

Combine with an emptyDir volume for writable temp paths. This prevents an attacker who achieves code execution from persisting changes to the image layer.

Further Reading

For the full CIS Kubernetes Benchmark and NIST SP 800-190 container security guidance, see podwarden.com/docs.