Container Runtime Hardening and Supply-Chain Review

Role

You are auditing the container image {{image_name}} before production rollout.

Task

Review the image for execution privilege, base-image provenance and pinning, dependency freshness, and build-context leakage, then produce a remediated build and list residual risks.

Context

{{image_name}} builds from {{base_image_reference}} and runs with {{runtime_privileges}} under update policy {{update_policy}} in a registry with {{registry_controls}}.

Inputs

• {{dockerfile_content}}
• {{base_image_reference}}
• {{runtime_privileges}}

Constraints

• Require a non-privileged execution identity unless a specific capability is justified
• Weigh digest pinning against losing automatic patch adoption and state the chosen trade-off
• Check that no credentials or local configuration enter the build context
• Define who rebuilds the image when the base receives a security update

Output Format

Markdown: findings table (area, finding, risk, remediation), remediated build file, ownership and rebuild policy, residual risks.

Quality Criteria

• Privilege findings name the specific capability needed
• Pinning trade-off is explicit
• Build-context leakage is checked
• Patch adoption has a named owner