Container Security — Build to Runtime

Image hardening, supply chain, runtime protection a scanning.

Build-time

FROM node:20-slim AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
RUN npm run build

FROM gcr.io/distroless/nodejs20-debian12
COPY --from=builder /app/dist /app
USER nonroot:nonroot
CMD ["server.js"]

Supply Chain

# Cosign signing
cosign sign --key cosign.key myregistry/myapp:v1.2.3

# Kyverno verification policy
spec:
  rules:
    - verifyImages:
        - imageReferences: ["myregistry/*"]

Runtime

• Falco — syscall monitoring
• Seccomp profiles
• Read-only filesystem
• Resource limits

Shrnutí

Container security = distroless + signed supply chain + admission policies + runtime monitoring.