Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
Take a working but bloated image and harden it for production: convert it to a MULTI-STAGE build so build tooling stays out of the final image, switch to a minimal base (alpine/slim/distroless), run as a non-root USER, keep no secrets in any layer, and add a HEALTHCHECK. Show the before/after image size and run an image vulnerability scan, addressing what it finds. Document the size reduction and the security choices.
A multi-stage build keeps build deps out of the final image; minimal base chosen; before/after size reduction shown.
Runs as a non-root USER; no secrets baked into layers; least-privilege; an image scan was run and findings addressed.
A HEALTHCHECK is defined; the container still works correctly after hardening.
Size numbers and scan results documented; the trade-offs of the chosen base image are explained.
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# An optimized, secure production image ## Goal Take a working but bloated image and harden it for production: convert it to a MULTI-STAGE build so build tooling stays out of the final image, switch to a minimal base (alpine/slim/distroless), run as a non-root USER, keep no secrets in any layer, and add a HEALTHCHECK. Show the before/after image size and run an image vulnerability scan, addressing what it finds. Document the size reduction and the security choices. ## Acceptance criteria - [ ] Multi-stage & size: A multi-stage build keeps build deps out of the final image; minimal base chosen; before/after size reduction shown. - [ ] Security hardening: Runs as a non-root USER; no secrets baked into layers; least-privilege; an image scan was run and findings addressed. - [ ] Operability: A HEALTHCHECK is defined; the container still works correctly after hardening. - [ ] Evidence: Size numbers and scan results documented; the trade-offs of the chosen base image are explained. ## Verification - [ ] Document installation and run commands. - [ ] Record automated checks and their exact commands. - [ ] Add representative output, screenshots, or a short demo where useful. - [ ] Confirm failure paths and known constraints. ## Decision log ### Decision title - Context: - Choice: - Alternatives considered: - Tradeoffs: ## Evidence - Link each rubric criterion to the file, test, or artifact that demonstrates it. ## Known limitations - List what is intentionally out of scope and what should be improved next.