multi-stage-build
Safeguard articles tagged "multi-stage-build" — guides, analysis, and best practices for software supply chain and application security.
7 articles
Multi-Stage Docker Builds: A Security Pattern, Not Just a Size Trick
Multi-stage builds are pitched as a way to shrink images. Their bigger payoff is security: build secrets, compilers, and toolchains that never reach production. Here is how to use them right.
How to Containerize a Node.js App Securely
The default Node.js Dockerfile runs as root, ships dev dependencies, and bakes secrets into layers. Here is a secure, multi-stage build you can copy, step by step.
Go and Docker: Building Secure Container Images
Go and Docker pair well because Go compiles to a static binary that fits in a tiny, near-empty image. This guide shows how to build that image securely.
Writing a Secure Node.js Dockerfile: Best Practices That Hold Up
A secure Node.js Dockerfile pins a specific base image, runs as a non-root user, and uses multi-stage builds to keep build tooling out of production. Here is a hardened template and why each line matters.
Docker and npm: How to Build Secure Node.js Images
Combining Docker and npm the naive way ships a bloated, vulnerable image. Here is how to build lean, reproducible, and secure Node.js containers.
Python Dockerfile Best Practices for Secure, Small Images
The Python Dockerfile best practices that matter most for security are running as a non-root user, choosing a slim base, using multi-stage builds, and pinning dependencies. Here is a working reference Dockerfile and why each line is there.
How to Write a Secure Node.js Dockerfile
A hardened Node.js Dockerfile starts with a pinned base image, a non-root user, and a multi-stage build. Here is how to write one that survives a real security review.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.