Hardened Docker images: locked versions, minimal layers, less room to bleed

Docker published a guide to hardened images — the kind that pin their dependencies, run as non-root, and skip the fat base layers. The idea is straightforward: cut the attack surface by giving the image fewer moving parts and fewer places to hide a vulnerability.

What makes them different from regular images? First, versions are locked — no "latest" tag that quietly pulls in a breaking change. Second, the base is lean — Alpine or distroless, not a full Linux distro with a dozen unused libraries. Third, the container runs as a non-root user, so even if a vulnerability gets exploited, it's harder to take over the whole system. And fourth, vulnerability scanning is baked in, so you catch known CVEs before they show up in a breach report.

This matters because most apps now run in containers, and the security story lives in the image. When your image is full of unpatched libraries and runs as root, a single zero-day can reach the kernel. Hardened images don't eliminate risk — they just make the odds work in your favor. La migra app, the cousin's side business, the auntie's Facebook shop — if it's running containers, it's running with or without the armor.

Why this matters for us: when your deployment stack is locked down, the next breach that hits the headlines has less to eat into your margins and your sleep.