Voir :

• Docker Buildx / BuildKit
• https://docs.docker.com/build/building/best-practices/
• https://docs.openshift.com/container-platform/4.17/openshift_images/create-images.html
• https://docs.oracle.com/en/operating-systems/oracle-linux/podman/security.html#security
• Exemple de Dockerfile pour Dokuwiki
• https://www.docker.com/blog/docker-best-practices-using-tags-and-labels-to-manage-docker-image-sprawl/
• https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry
• https://blog.stephane-robert.info/docs/conteneurs/moteurs-conteneurs/
• https://aws.amazon.com/fr/blogs/france/demystifier-entrypoint-et-cmd-dans-docker/

Ansible :

• https://oneuptime.com/blog/post/2026-03-18-use-podman-with-ansible/view

Outils / Méthode / Container Image Builders :

• Docker / Dockerfile
• Buildah
• * Buildpacks / pack https://blog.stephane-robert.info/docs/conteneurs/images-conteneurs/build/buildpacks/
• openshift-imagebuilder
• Source-To-Image (S2I)
• Kaniko https://blog.stephane-robert.info/docs/conteneurs/images-conteneurs/build/kaniko/
• S2I
• CNB
• Paketo
• umoci

Voir :

• https://www.sysdig.com/learn-cloud-native/dockerfile-best-practices
• https://collabnix.com/running-docker-containers-as-root/
• https://www.docker.com/blog/understanding-the-docker-user-instruction/
• https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html
• https://blog.stephane-robert.info/docs/conteneurs/outils/hadolint/
• https://medium.com/@SecurityArchitect/hardening-container-images-best-practices-and-examples-for-docker-e941263cab13
• https://github.com/nicolargo/glances/issues/3359

Quand cela est possible préférer COPY à ADD. Voir https://docs.docker.com/build/building/best-practices/

Immediately before your ENTRYPOINT or CMD directive, you then add a USER

Ne pas utiliser sudo mais gosu ou su-exec

Voir :

• https://blog.stephane-robert.info/docs/conteneurs/outils/hadolint/

podman run --rm -i docker.io/hadolint/hadolint < Dockerfile

https://github.com/browserless/chrome/blob/master/start.sh

start.sh

#!/bin/bash
set -e
 
# When docker restarts, this file is still there,
# so we need to kill it just in case
[ -f /tmp/.X99-lock ] && rm -f /tmp/.X99-lock
 
_kill_procs() {
  kill -TERM $node
  kill -TERM $xvfb
}
 
# Relay quit commands to processes
trap _kill_procs SIGTERM SIGINT
 
Xvfb :99 -screen 0 1024x768x16 -nolisten tcp -nolisten unix &
xvfb=$!
 
export DISPLAY=:99
 
dumb-init -- node ./build/index.js $@ &
node=$!
 
wait $node
wait $xvfb

Dockerfile

CMD ["./start.sh"]

voir https://www.grottedubarbu.fr/buildah-basics/

docker build

buildah bud -t myapp:latest .

L'option bud est en réalité une version courte de l'option build-using-dockerfile

# Copier nginx vers la registry locale
crane copy nginx:1.27.3-alpine localhost:5000/nginx:1.27.3-alpine --platform linux/amd64

# Aplatir l'image
crane flatten localhost:5000/nginx:1.27.3-alpine \
  -t localhost:5000/nginx:1.27.3-alpine-flat

Source : https://blog.stephane-robert.info/docs/conteneurs/outils/crane/

RUN apk add --no-cache shadow

export DOCKER_BUILDKIT=0