Pods must run as non-root with read-only root filesystem
Set securityContext.runAsNonRoot=true, runAsUser!=0, and readOnlyRootFilesystem=true on pods/containers.
infra-as-codesecurity-hardening+1
High
Add explicit environment variable checks
Validate required runtime env vars at container start via an entrypoint script; exit with a clear message on missing values.
config-environmentcontainer-docker-hygiene+1
High
Implement multi-stage builds for production
Use a builder stage for toolchains/dev deps and a minimal runtime stage that contains only runtime artifacts.
container-docker-hygienesecurity-hardening
High
Pin exact versions with digests for base images
Base images must be pinned to an exact version and content digest (@sha256) to guarantee reproducible builds and supply-chain integrity.
container-docker-hygienedependency-supply-chain
High
Protect backups/exports of ePHI with KMS and restricted buckets
Write ePHI backups to storage with server-side encryption (SSE-KMS) and least-privilege access; disallow public ACLs and cross-account access without a BAA. Record the KMS key id in metadata.
compliance-hipaasecurity-hardening+2
Low
Choose appropriate npm commands for build stages
Use `npm ci` for reproducible installs in build stages; in runtime, run `npm prune --omit=dev` or install with `--omit=dev`.
container-docker-hygienedependency-supply-chain
Low
Clean up build tools after dependency installation
If a single-stage image must build native deps, remove compilers/headers after install and clear package caches in the same layer.
container-docker-hygieneperformance-efficiency
Low
Consolidate duplicate Dockerfiles
Deduplicate near-identical Dockerfiles by sharing a common base stage (multi-stage) and varying only service-specific steps via build args/targets.
container-docker-hygieneduplication-complexity
Low
Extract hardcoded versions to centralized configuration
Parameterize tool/runtime versions via ARGs (and CI build args) instead of hardcoding them across multiple Dockerfiles.
container-docker-hygieneduplication-complexity+1
Low
Optimize Docker layer caching strategy
Copy and install dependencies before application sources; ensure .dockerignore excludes node_modules and build outputs.
container-docker-hygieneperformance-efficiency
Low
Pin specific patch versions for Node.js
Use a fully qualified Node.js tag including major.minor.patch, not floating majors/minors.
container-docker-hygienedependency-supply-chain
Low
Remove unnecessary files from production images
Ship only runtime artifacts (binaries, compiled assets, minimal configs). Exclude tests, sources, docs, and dev tooling.