Skip to main content

Hardening (Image Configuration)

Image hardening is an analysis that checks whether the container image and Dockerfile configuration follow security best practices. Even when the software inside the image has no vulnerabilities, the attack surface changes greatly depending on how the image is built and with what privileges it runs. It checks whether the container runs as non-root, whether build-only tools or shells were left behind in the runtime image, whether a healthcheck exists, and whether more privilege than necessary was granted, making the image safer. Used by the Container image service.

  • Analysis : Image hardening (configuration best-practice) violations
  • What you need : A registered container image service
  • Results : Hardening violation items

What it finds​

Checks whether the image configuration follows best practices.

  • Running as root : The container is configured to run as root.
  • Unnecessary packages : Build tools/shells that widen the attack surface remain in the runtime image.
  • Missing health check, unsafe defaults, excessive privileges.

Handling results​

  • Found items are handled in Vulnerability management just like other analyses.
  • Configurations that are intentional per organization policy are marked as accepted risk.