secure-container-build

Build secure container images using Wolfi glibc-dynamic runtime with multi-stage builds to separate builder and runtime stages. This approach minimizes runtime footprint while running as a non-root user (UID 65532) by default, reducing attack surface and image bloat.

Yes. Multi-stage build templates support Python/uv, Bun, Node.js/pnpm, Golang (static and CGO), and Rust (glibc and musl). Each template is optimized for its runtime, with cache-aware BuildKit patterns and allocator options for specialized needs.

Configure containers to run as a non-root user by setting UID 65532 in the runtime stage. Combine this with Wolfi base images and tini init to handle signals properly, ensuring secure, production-ready execution without privilege escalation risk.

Use tini as an init system within your container's runtime stage to properly manage signals and child processes. This prevents zombie processes and ensures graceful shutdown, critical for production workloads across all supported runtimes.

Yes. These Containerfile templates are built for Podman and leverage BuildKit cache-optimization patterns. Podman's rootless mode aligns with the non-root user configuration, enhancing security during both build and runtime.

Apply allocator optimization options when building Rust containers to reduce memory overhead and improve performance in resource-constrained environments. Choose between glibc and musl runtime variants based on your deployment context and compatibility needs.