← All challenges
mediumdevops~25 min

Harden a Dockerfile

A container image runs as root, floats on the latest tag, and bakes an API token into a layer. Fix the Dockerfile to a pinned base, a non-root user, and no secrets in the image.

Scenario

This image ships three classic problems: it builds on node:latest (unpinned, so your build changes under you), it runs as root, and it bakes an API token into an image layer (anyone who pulls the image can read it). Harden the Dockerfile.

Your job

Edit the Dockerfile so that:

  • the base image is pinned to a specific tag or digest (not latest),
  • the container runs as a non-root USER, and
  • no secret is baked into an ENV/ARG layer.

How it's graded

Structural check on the instructions (we read the Dockerfile, we don't build it). Secrets should be provided at runtime (--env, a mounted file, a secret store), never written into the image.

Teaches: container image hardening: pinned bases, least-privilege runtime user, and keeping secrets out of layers.

What gets checked

Your solution is verified against each of these:

  • The base image is pinned to a specific tag or digest (not latest)
  • The container runs as a non-root USER
  • No secret is baked into an ENV/ARG layer

Solve it in your browser

No setup, no install. Write your solution in the editor and hit Check. The in-house engine renders and grades it instantly, then issues your proof the moment every check passes.

Solve in browser →

Prefer your own lab?

  1. Build the fix locally. New to the tooling? See setting up your lab.
  2. Push your topology file, device configs, and any playbooks to a public repo (GitHub or GitLab).
  3. Submit the repo link. We review it by hand, confirm it works, and issue your proof page.
Submit your solution →