VocalHyre
Sign up

Docker · Containers in practice

How do you secure a container image?

Hardimage securityscanningsupply chainUpdated Oct 2026
Quiz this track

Short answer

Start from a minimal trusted base, pin digests, scan for vulnerabilities, sign and attest images, and rebuild regularly. Treat the image as a supply-chain artifact, not just a build output.

Image security covers what is inside the image, where it came from, and whether it has been tampered with. A scan at build time is necessary but not sufficient, because new CVEs are disclosed after the build.

sh
trivy image --severity HIGH,CRITICAL api:1.0.0
cosign sign --key cosign.key registry.example.com/api@sha256:abc123
docker buildx imagetools inspect registry.example.com/api:1.0.0
Scan the final image, sign the digest and inspect the resolved manifest.

Controls that matter

  • Pin base images by digest and rebuild on a schedule for patches
  • Use a minimal base to reduce the package surface
  • Run as non-root and drop unnecessary capabilities
  • Generate an SBOM so you can answer what is inside the image
  • Enforce a scan gate in CI and block critical findings with a documented exception process
  • Verify signatures and digests at deploy time

A scanner reports known CVEs; it does not detect malware or a compromised upstream account. Provenance, signature verification and reproducible builds address different parts of the supply chain.

Do not chase a zero-vulnerability report by hiding findings. Some CVEs are not exploitable in your context, but that decision should be documented, not suppressed.

Follow-ups you should expect

Interviewers use these to check whether the first answer was understanding or memorisation.

  1. 1Why is a build-time scan not enough?
  2. 2What does signing an image prove?
  3. 3How do you handle a critical CVE in a base image?
  4. 4What is an SBOM used for?

Say it in the interview

I treat images as supply-chain artifacts. I pin base images by digest, keep them minimal, scan the final image in CI, and rebuild regularly so patches actually reach production. I also sign images and generate an SBOM, then verify signatures at deploy time. A scan alone is not enough, because new vulnerabilities appear after the build.

Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.

Related questions

HardHow do you harden a container at runtime?HardHow do you handle secrets in Docker builds and at runtime?MediumWhy and how should containers run as non-root?

Reading is step one

Now say it out loud.

Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Docker mock interview and get scored feedback on depth, clarity and confidence.

Start a free Docker interviewBrowse all questions