Auditing Final Image Contents

Auditing Final Image Contents

In this lesson, you will learn how to verify that your production image contains only the bare necessities required to run your application.

Even when using multi-stage builds and minimal base images, it is surprisingly easy to accidentally leak build-time secrets, source code, or compilers into your final container. Think of your final image like a carry-on suitcase: you want to make sure that before you "board" your container into a production cluster, you haven't packed any unnecessary items that could increase your attack surface or bloat your deployment.

How to Inspect the Goods

To perform a manual audit, you don't just rely on the Dockerfile—you inspect the actual image filesystem. You can start by using docker run --rm -it <your-image-name> /bin/sh (or /bin/bash) to manually poke around. However, for a more structured audit, we use image inspection tools like dive or docker image history.

For example, checking the contents of your final stage using docker image history helps you spot if large blobs were added during a step that should have been pruned:

# View the layers and commands that created the image
docker image history --no-trunc <your-image-name>

If you see a layer containing /root/.npm or gcc, you know your cleanup didn't work as expected.

Another effective approach is to run a "diff" against your base image. If you are using a Distroless base image, your final image should look almost identical to the base image, plus only your specific application binary and necessary config files. If your image size is significantly larger than your base, it is time to audit:

1. Check /tmp and /var/cache: Are there stray logs or build artifacts left behind?
2. Scan for source code: Ensure you didn't accidentally COPY . . into the final stage instead of copying only the compiled binary.
3. Inspect installed packages: Run apk info or dpkg -l inside the container to ensure no build-time development headers were carried over.

By regularly auditing your final image contents, you ensure that your production environment remains lean, secure, and predictable.

Key Takeaway: Auditing is the final quality gate; always inspect your production image’s filesystem to ensure it contains only the runtime binary and essential dependencies, keeping your attack surface at a absolute minimum.