dockerfile 17 lines · 1 tab

Dockerfile hardening for smaller safer containers

Kai Nakamura Apr 2026

1 tab

FROM ruby:3.3.1-slim AS base

RUN apt-get update \
  && apt-get install -y --no-install-recommends build-essential libpq-dev \
  && rm -rf /var/lib/apt/lists/*

WORKDIR /app
RUN groupadd --system app && useradd --system --gid app --create-home app

COPY Gemfile Gemfile.lock ./
RUN bundle config set deployment 'true' && bundle install --without development test

COPY . .
RUN chown -R app:app /app

USER app
CMD ["bundle", "exec", "puma", "-C", "config/puma.rb"]

1 file · dockerfile Explain with highlit

Container security starts with the image build. I use small trusted bases, non-root users, explicit file ownership, and multi-stage builds that leave tooling behind. The fewer packages and privileges in the final image, the less there is to exploit.

Related snips

plaintext

Protocol 2
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes
AllowUsers deploy ops

SSH daemon hardening and key based access only

ssh linux hardening

by Kai Nakamura 1 tab

bash

#!/usr/bin/env bash
set -euo pipefail

find / -perm -4000 -type f 2>/dev/null | sort
sudo -l
find /etc/systemd/system -type f -writable 2>/dev/null

Linux privilege escalation checks for suspicious local state

privilege-escalation linux auditing

by Kai Nakamura 1 tab

javascript

// Express app with health checks and graceful shutdown
const express = require('express');
const { createServer } = require('http');

const app = express();
const server = createServer(app);

Container health checks and graceful shutdown patterns

docker kubernetes health-checks

by Ryan Nakamura 1 tab

bash

#!/usr/bin/env bash
set -euo pipefail

bundle exec bundler-audit check --update
npm audit --audit-level=high
pip-audit --strict

Dependency vulnerability scanning for Ruby and Node projects

dependency-scanning supply-chain ruby

by Kai Nakamura 1 tab

plaintext

bind 127.0.0.1 10.0.0.15
protected-mode yes
port 6379
rename-command FLUSHALL ""
rename-command CONFIG ""
aclfile /etc/redis/users.acl

Redis hardening with ACLs protected mode and network isolation

redis hardening infrastructure

by Kai Nakamura 1 tab

yaml

- name: Build image
  run: docker build -t app:${{ github.sha }} .

- name: Scan image
  uses: aquasecurity/trivy-action@0.24.0
  with:

Trivy image scanning in pull request pipelines

trivy containers ci

by Kai Nakamura 1 tab

Share this code

Here's the card — post it anywhere.

Dockerfile hardening for smaller safer containers — share card

Link copied