Sécurité des images de conteneurs en 2026 : guide complet

# Multi-stage : build complet vs runtime minimal
FROM golang:1.23-bookworm AS builder
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -ldflags='-s -w' -o /app/server ./cmd/server
 
# Stage final : distroless avec seulement le binaire
FROM gcr.io/distroless/static-debian12:nonroot
COPY --from=builder /app/server /server
USER nonroot:nonroot
EXPOSE 8080
ENTRYPOINT ["/server"]

# Mauvais : par défaut, USER root
FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y nginx
CMD ["nginx", "-g", "daemon off;"]
# Container exécuté en root, capabilities root sur l'image
 
# Bon : utilisateur dédié non-root
FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y nginx \
 && groupadd -g 10001 app \
 && useradd -u 10001 -g app -s /sbin/nologin -M app \
 && chown -R app:app /var/cache/nginx /var/log/nginx
USER 10001:10001
CMD ["nginx", "-g", "daemon off;"]

# Kubernetes : pod sécurisé
apiVersion: v1
kind: Pod
metadata:
  name: secure-app
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 10001
    runAsGroup: 10001
    fsGroup: 10001
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: app
    image: my-registry.example.test/app@sha256:abc123...
    securityContext:
      allowPrivilegeEscalation: false
      privileged: false
      readOnlyRootFilesystem: true
      capabilities:
        drop: ["ALL"]
    resources:
      limits:
        memory: "256Mi"
        cpu: "500m"
      requests:
        memory: "128Mi"
        cpu: "100m"
    volumeMounts:
    - name: tmp
      mountPath: /tmp
  volumes:
  - name: tmp
    emptyDir: {}

docker run \
  --read-only \
  --tmpfs /tmp \
  --user 10001:10001 \
  --cap-drop ALL \
  --security-opt no-new-privileges \
  --security-opt seccomp=default.json \
  my-registry.example.test/app@sha256:abc123...

# .dockerignore type pour application Node.js
.git
.github
node_modules
npm-debug.log
.env*
*.log
.vscode
.idea
.DS_Store
coverage/
test/
docs/
*.md
Dockerfile*
docker-compose*
.terraform
*.tfstate*
secrets/

# Mauvais : tag mutable
FROM python:3.12-slim
 
# Bon : digest immuable + commentaire de version
FROM python:3.12-slim@sha256:7c8b41e8f8a9b6c5d3e2a1f4b7c8e9d0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6
# python:3.12-slim au 2026-04-15

# DANGEREUX : secret persiste dans l'image
FROM debian:bookworm-slim
ARG NPM_TOKEN
ENV NPM_TOKEN=$NPM_TOKEN
RUN echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" > ~/.npmrc \
 && npm install
# Le NPM_TOKEN apparaît dans docker history et dans toutes les layers ENV

# syntax=docker/dockerfile:1.7
FROM debian:bookworm-slim
 
# Le secret est monté en mémoire pendant l'exécution du RUN seulement
RUN --mount=type=secret,id=npm_token,target=/root/.npmrc \
    cat /root/.npmrc \
 && npm install
# Aucune trace du secret dans les layers de l'image finale

# Activer BuildKit (par défaut depuis Docker 23.0)
export DOCKER_BUILDKIT=1
 
# Build avec secret monté
docker build \
  --secret id=npm_token,src=$HOME/.secrets/npm-token.txt \
  -t my-app:latest .

- uses: docker/build-push-action@v6
  with:
    secrets: |
      "npm_token=${{ secrets.NPM_TOKEN }}"

# GitHub Actions : signature keyless via OIDC GitHub
permissions:
  contents: read
  id-token: write     # requis pour OIDC keyless
  packages: write
 
steps:
  - uses: sigstore/cosign-installer@v3
 
  - name: Build et push image
    id: build
    uses: docker/build-push-action@v6
    with:
      push: true
      tags: ghcr.io/my-org/my-app:${{ github.sha }}
 
  - name: Sign image (keyless)
    run: |
      cosign sign --yes \
        ghcr.io/my-org/my-app@${{ steps.build.outputs.digest }}
 
  - name: Generate SBOM
    uses: anchore/sbom-action@v0
    with:
      image: ghcr.io/my-org/my-app@${{ steps.build.outputs.digest }}
      format: cyclonedx-json
      output-file: sbom.cyclonedx.json
 
  - name: Attest SBOM
    run: |
      cosign attest --yes \
        --predicate sbom.cyclonedx.json \
        --type cyclonedx \
        ghcr.io/my-org/my-app@${{ steps.build.outputs.digest }}

# Vérifier la signature et la provenance attendue
cosign verify \
  --certificate-identity-regexp='^https://github.com/my-org/my-app/' \
  --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
  ghcr.io/my-org/my-app@sha256:abc123...
 
# Vérifier l'attestation SBOM
cosign verify-attestation \
  --type cyclonedx \
  --certificate-identity-regexp='^https://github.com/my-org/my-app/' \
  --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
  ghcr.io/my-org/my-app@sha256:abc123...

# Refuser les images non signées par notre identité GitHub Actions
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-image-signature
spec:
  validationFailureAction: Enforce
  rules:
  - name: verify-cosign
    match:
      any:
      - resources:
          kinds: [Pod]
    verifyImages:
    - imageReferences:
      - "ghcr.io/my-org/*"
      attestors:
      - entries:
        - keyless:
            subject: "https://github.com/my-org/*"
            issuer: "https://token.actions.githubusercontent.com"
 
# Refuser les containers root
---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-non-root
spec:
  validationFailureAction: Enforce
  rules:
  - name: check-runAsNonRoot
    match:
      any:
      - resources:
          kinds: [Pod]
    validate:
      message: "Le container doit s'exécuter en non-root (runAsNonRoot: true)"
      pattern:
        spec:
          containers:
          - securityContext:
              runAsNonRoot: true
              allowPrivilegeEscalation: false

# Pod avec seccomp profile RuntimeDefault (recommandé)
securityContext:
  seccompProfile:
    type: RuntimeDefault
 
# Ou profile custom localisé
securityContext:
  seccompProfile:
    type: Localhost
    localhostProfile: profiles/my-app.json

# Pod avec AppArmor profile
metadata:
  annotations:
    container.apparmor.security.beta.kubernetes.io/app: localhost/my-app-profile

# Kubernetes : RuntimeClass pour gVisor
apiVersion: node.k8s.io/v1
kind: RuntimeClass
metadata:
  name: gvisor
handler: runsc
---
apiVersion: v1
kind: Pod
spec:
  runtimeClassName: gvisor
  containers:
  - image: untrusted/code:latest

# Audit d'un Dockerfile
hadolint Dockerfile
 
# En CI GitHub Actions
- uses: hadolint/hadolint-action@v3
  with:
    dockerfile: Dockerfile
    failure-threshold: warning

# Inspection interactive d'une image (taille par layer, fichiers)
dive my-image:latest
 
# Mode CI pour vérifier l'efficacité (ratio espace utile / espace total)
CI=true dive my-image:latest --ci-config dive-ci.yaml

# SBOM d'une image au format CycloneDX
syft packages docker:my-image:latest -o cyclonedx-json=sbom.json

# syntax=docker/dockerfile:1.7
 
# ============================================================
# Stage 1 — Builder avec Go toolchain complète
# ============================================================
FROM golang:1.23-bookworm@sha256:abc123def456789012345678901234567890abcdef123456789012345678901234 AS builder
 
WORKDIR /src
 
# Cache des dépendances en layer séparée
COPY go.mod go.sum ./
RUN --mount=type=cache,target=/go/pkg/mod \
    go mod download
 
# Copie du code source et build statique
COPY . .
RUN --mount=type=cache,target=/go/pkg/mod \
    --mount=type=cache,target=/root/.cache/go-build \
    CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
    go build -trimpath -ldflags='-s -w -buildid=' \
    -o /app/server ./cmd/server
 
# ============================================================
# Stage 2 — Image finale distroless static
# ============================================================
FROM gcr.io/distroless/static-debian12:nonroot@sha256:def456abc789012345678901234567890abcdef123456789012345678901234567
 
# Métadonnées OCI
LABEL org.opencontainers.image.title="my-app"
LABEL org.opencontainers.image.description="Application Go production-ready"
LABEL org.opencontainers.image.source="https://github.com/my-org/my-app"
LABEL org.opencontainers.image.licenses="Apache-2.0"
 
# Binaire compilé du builder
COPY --from=builder --chown=nonroot:nonroot /app/server /server
 
# Port non-privilégié
EXPOSE 8080
 
# Utilisateur non-root (UID 65532 dans distroless nonroot)
USER nonroot:nonroot
 
# Pas de SHELL : ENTRYPOINT direct au binaire
ENTRYPOINT ["/server"]