DevSecOps › Module 7 › Lesson 3
Base Image Hygiene
Base image hygiene literacy — minimal base, digest pinning, non-root user, no secrets in layers, rebuild cadence — hygiene rows on YOUR `$DEVSEC_LAB` Dockerfiles.
Visual · t36_base_image_hygiene
Base image hygiene = named Dockerfile rows. $DEVSEC_LAB. Original Cyberlium.
Opening
Fat base images import CVE debt — name Dockerfile hygiene rows on YOUR lab images before copying stranger Dockerfiles with embedded secrets.
Base image hygiene literacy names: minimal base image category (distroless/alpine literacy stub), digest pinning category, non-root USER directive category, no-secrets-in-layers category, and rebuild cadence category. Analyst documents base image hygiene checklist on `$DEVSEC_LAB` Dockerfile — five rows with pass/fail criteria — without using `:latest` tags on lab CI, without embedding API keys in image layers, without copying stranger org Dockerfiles with unknown provenance. Cyberlium teaches container build hygiene on YOUR notes — defender shift-left only. Refused: secret-in-layer, unpinned tags, stranger Dockerfile clones without review. Lab row: base image hygiene checklist (five rows, pass/fail, digest stub).
1. Named hygiene rows
Minimal base, digest pin, non-root user, no secrets, rebuild cadence — five literacy anchors.
Each row cites YOUR lab Dockerfile — not random Docker Hub image.
Command guide
Try these commands — Named hygiene rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OWASP ZAP — https://www.zaproxy.org/ ZAP Docker — https://www.zaproxy.org/docs/docker/about/ ZAP baseline — https://www.zaproxy.org/docs/docker/baseline-scan/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
export DEVSEC_DAST=${DEVSEC_DAST:-$DEVSEC_LAB/dast}
echo '=== Verify YOUR localhost app (start container/app.sh in another terminal if needed) ==='
curl -sS --connect-timeout 2 http://127.0.0.1:8080/ 2>/dev/null | head -3 || echo 'App not running — start YOUR lab app on 127.0.0.1:8080 first'
cat > "$DEVSEC_DAST/zap-optional-run.sh" <<'EOF'
#!/bin/sh
# YOUR localhost ONLY — optional ZAP baseline
TARGET="http://127.0.0.1:8080"
echo "ZAP baseline target: $TARGET (localhost only)"
curl -sS --connect-timeout 2 "$TARGET" | head -3 || { echo 'Start YOUR app first'; exit 1; }
if command -v docker >/dev/null; then
docker run --rm --network host owasp/zap2docker-stable zap-baseline.py -t "$TARGET" -r "$HOME/cyberlium-lab/t36-devsec/dast/zap-report.html" 2>&1 | tail -20
else
echo 'docker not installed — baseline-plan.md documents manual curl + ZAP GUI on localhost'
fi
EOFCommand — copy this
chmod +x "$DEVSEC_DAST/zap-optional-run.sh" grep -E '127.0.0.1|localhost' "$DEVSEC_DAST/zap-optional-run.sh" curl -sS https://www.zaproxy.org/docs/docker/baseline-scan/ | head -8
Primary tools to practice this lesson: curl, grep. Reference sites: OWASP ZAP (https://www.zaproxy.org/); ZAP Docker (https://www.zaproxy.org/docs/docker/about/); ZAP baseline (https://www.zaproxy.org/docs/docker/baseline-scan/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Digest pinning discipline
Image digest pinned in lab Dockerfile — document stub on checklist.
Link Module 7-1 CVE rows — smaller base reduces scan surface literacy.
3. Refused
No secrets in layers; no `:latest` on CI; no unreviewed stranger Dockerfiles.
Hygiene literacy supports secure builds — not supply chain shortcuts.
4. What you ship: base image hygiene checklist
Five hygiene rows + pass/fail + digest pin stub + NEVER secret-in-layer line.
5. What you record before the next lesson
Base image hygiene checklist path.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Embed lab API key in Dockerfile ENV because 'it's just a training image.'
Right
Base image hygiene checklist from `$DEVSEC_LAB` Dockerfile. Next: Container Lab.
Mission: base image hygiene checklist
1) Name five base image hygiene rows. 2) Pass/fail criteria per row. 3) Digest pin stub documented. 4) Write NEVER secret-in-layer line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Distroless vs alpine — literacy tradeoff stub?”
Knowledge Check
APPLY: Base image hygiene uses:
Multiple choice
Knowledge Check
APPLY: True or False: API keys in Dockerfile ENV are acceptable on lab.
True or False
Knowledge Check
APPLY: Hygiene checklist includes:
Multiple choice