Your Docker image runs as root with secrets baked in

Your Dockerfile works, so you never went back to check what's actually running inside that image.

Beginner to intermediateRead 4 minDoing: a couple of hours7 steps

▶ Start

What you'll have at the end

A Dockerfile that runs as a non-root user with no secrets baked into the image

Before you start

You need

A Dockerfile that already builds and runs a real backend service, with at least one build-time credential or a copied environment file somewhere in it.

Not covered

Wiring your runtime configuration through a secrets manager so the running container never needs a local credential file at all.

Leans on

Dockerfile Cheat Sheetthe exact instructions and BuildKit features this recipe rewrites your Dockerfile around.
Docker Cheat Sheetthe commands this recipe runs against a built image to see what is really inside it.

7 steps

Where to go next

Generate an SBOM and block a deploy that ships a known CVE

once the image itself is clean, that recipe wires an automatic scan into every future build so this kind of check runs on its own instead of by hand.

Checked 19 Aug 2026

Part of the Backend Deployment cookbook