1. Hardening Docker Images & Multi-Stage Builds

Layer Caching & Order of Execution

Docker builds images as read-only layers. Order instructions from least frequently changed (OS dependencies, package manifests) to most frequently changed (source code) to maximize layer cache hits in CI runners.

FROM node:22-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

FROM gcr.io/distroless/nodejs22-debian12
WORKDIR /app
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
USER nonroot:nonroot
CMD ["dist/server.js"]

Distroless & Non-Root Containers

Standard OS base images bundle package managers, shells, and binaries (curl, bash) that expand the CVE attack surface. Distroless images contain strictly your application and runtime dependencies, eliminating shell-spawn exploits.