Key takeaways

Set a non-root numeric USER; container root is one bug from host root.

Deleting a secret in a later layer doesn't remove it; use BuildKit secret mounts.

Pin base images by version and digest, and install from lockfiles.

Never pipe curl into a shell; verify checksums.

Update, install and clean in one RUN, and rebuild on a schedule.

A Dockerfile is a security boundary written by people who are mostly trying to get the build green. That's why the same problems keep coming back: few of them are exotic vulnerabilities, and most are defaults copied from a tutorial and never revisited. Each one is cheap to fix once you know to look for it.

The security mistakes come first, roughly in order of how much damage they enable. A shorter section on reliability follows, because a container you can't stop or health-check cleanly also makes incidents harder to handle.

1. Running as root

If a Dockerfile never sets USER , the process runs as root (UID 0) inside the container.…