Security scan found critical vulnerabilities in your base image. How do you fix them?

Step 1: Update Base Image

# BEFORE: Old image with vulnerabilities
FROM node:18

# AFTER: Specific patched version
FROM node:18.19.0-bookworm-slim

# Or even better - Alpine (fewer packages = fewer vulns)
FROM node:18.19.0-alpine3.19

Check for updates:

# Find latest tags
docker pull node:18-alpine
trivy image node:18-alpine

# Compare vulnerability counts
trivy image node:18          # ~150 vulns
trivy image node:18-slim     # ~50 vulns
trivy image node:18-alpine   # ~5 vulns

Step 2: Use Multi-Stage Build to Minimize Attack Surface

# Build stage - has build tools with potential vulns
FROM node:18 AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

# Production stage - minimal runtime only
FROM node:18.19.0-alpine3.19 AS production

# Don't include npm, yarn, or build tools
RUN apk add --no-cache tini

WORKDIR /app

# Copy only production dependencies
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/package.json ./

USER node
ENTRYPOINT ["/sbin/tini", "--"]
CMD ["node", "dist/server.js"]

Step 3: Use Distroless for Maximum Security

FROM node:18 AS builder
WORKDIR /app
COPY . .
RUN npm ci && npm run build

# Distroless has no shell, no package manager, minimal OS
FROM gcr.io/distroless/nodejs18-debian12

COPY --from=builder /app/dist /app/dist
COPY --from=builder /app/node_modules /app/node_modules

WORKDIR /app
USER nonroot
CMD ["dist/server.js"]

Distroless scan:

$ trivy image gcr.io/distroless/nodejs18-debian12
Total: 0 (CRITICAL: 0, HIGH: 0, MEDIUM: 0, LOW: 0)

Step 4: CI/CD Integration

# GitHub Actions - fail on critical vulnerabilities
name: Security Scan

on: [push, pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build image
        run: docker build -t myapp:${{ github.sha }} .

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: myapp:${{ github.sha }}
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'  # Fail pipeline on vulnerabilities

      - name: Upload Trivy scan results
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results.sarif'

Step 5: Automated Base Image Updates

# Renovate config - auto-update Dockerfile base images
# renovate.json
{
  "extends": ["config:base"],
  "dockerfile": {
    "enabled": true,
    "fileMatch": ["Dockerfile$", "Dockerfile\\.[a-z]+$"]
  },
  "packageRules": [
    {
      "matchDatasources": ["docker"],
      "matchUpdateTypes": ["patch", "minor"],
      "automerge": true
    }
  ]
}