LowFile-scopeDockerfile Plug & play

Extract hardcoded versions to centralized configuration

Parameterize tool/runtime versions via ARGs (and CI build args) instead of hardcoding them across multiple Dockerfiles.

Why this matters

Centralization prevents configuration drift and makes upgrades a single-point change.

Side-by-side examples engineers can pattern-match during review.

Avoid

FROM node:20.11.1-alpine
ENV YARN_VERSION=4.1.0
RUN corepack enable && corepack prepare yarn@4.1.0 --activate

Prefer

ARG NODE_VERSION=20.11.1
FROM node:${NODE_VERSION}-alpine
ARG YARN_VERSION
RUN corepack enable && corepack prepare yarn@${YARN_VERSION} --activate

Bad

ENV PNPM_VERSION=8.15.0 # repeated in many files

Good

ARG PNPM_VERSION
RUN corepack prepare pnpm@${PNPM_VERSION} --activate

From the same buckets as this rule.

Critical
Pods must run as non-root with read-only root filesystem
Set securityContext.runAsNonRoot=true, runAsUser!=0, and readOnlyRootFilesystem=true on pods/containers.
infra-as-codesecurity-hardening+1
High
Add explicit environment variable checks
Validate required runtime env vars at container start via an entrypoint script; exit with a clear message on missing values.
config-environmentcontainer-docker-hygiene+1
High
Implement multi-stage builds for production
Use a builder stage for toolchains/dev deps and a minimal runtime stage that contains only runtime artifacts.
container-docker-hygienesecurity-hardening