Best practices for containers

This page provides information about best practices for building and securing container images.

Building containers

The approach that you take to creating your containers can impact the speed of builds and deployments, as well as the effort required to maintain your images.

Learn best practices for creating containers that are easier build and run. The guidance includes information about Container Registry for container storage, but the overall guidance still applies to containers you use with Artifact Registry.

You can also read the Docker best practices for building images.

Securing the software supply chain

Learn about keeping your software secure throughout the software lifecycle.

Assessing container security

The Center for Internet Security (CIS) has a Docker Benchmark for evaluating the security of a Docker container.

Docker provides an open source script called Docker Bench for Security. You can use the script to validate a running Docker container against the CIS Docker Benchmark.

Docker Bench For Security can help you verify many items in the CIS Docker Benchmark, but not all items are verifiable with the script. For example, the script cannot verify if the host for the container is hardened or if the container image includes personal data. Review all items in the benchmark and identify those that might need additional verification.