Image size, security and best practices — Docker & Containers

6. Image size, security and best practices

Intermediate★ Must knowLesson 6 of 8

Multi-stage builds; minimal base images (aspnet, chiseled, Alpine); pin versions (aspnet:10.0 or a digest).
Run as non-root (USER app); read-only root filesystem where possible; drop Linux capabilities.
No secrets in images (not in ENV, ARG or copied files — they stay in layer history). Inject at runtime via environment/secret stores (Key Vault, Kubernetes Secrets, Docker secrets); use BuildKit --mount=type=secret for build-time secrets.
Order instructions from least to most frequently changing for cache hits; combine RUN steps and clean package caches in the same layer.
.dockerignore to keep the build context small and avoid leaking files.
Scan images in CI (Trivy, Docker Scout, Defender) and rebuild regularly to pick up base image patches.
One process (concern) per container; log to stdout/stderr.
Add HEALTHCHECK (Docker/Compose) or liveness/readiness probes (Kubernetes).
Handle SIGTERM for graceful shutdown (ASP.NET Core does by default; keep the exec form).
Sign images (Notation/cosign) and use immutable tags.