Security around the build process
We've seen how we can pull images and run them in a secure fashion. But what about building our own container images? As you are now familiar with, some commands pose additional risks when added to the Dockerfile. In this section of the chapter, we will look at how we can secure the build process using the techniques we have learned so far. This will include using a minimal base image (shipitclicker) as a starting point and then using the security tweaks we have tested against this image when running it as a container.
Using multi-stage builds
As we previously covered, we need to be careful about secrets and ensure they are not accidentally leaked. One way to avoid this is to not include them in the Dockerfile. However, what about at the build stage? It's likely you will need to use private keys in conjunction with the build process from time to time, for example, to pull code from a remote service that is protected with public key...