Docker hardened images are a category of container images designed for supply chain security and production workloads. They contain only the minimal runtime needed to run an application — for example, a Node.js hardened image ships without npm or Yarn, and may not even include a shell. This limits the blast radius if a container is compromised. The tradeoff is reduced flexibility: developers may need to restructure their Dockerfiles to install dependencies in an earlier build stage. To ease development, many hardened images offer a 'dev' variant that includes a shell and package managers, which can be used locally or as a build stage before producing the lean final image.
•2m watch time