LowFile-scopeDockerfile Plug & play

Pin specific patch versions for Node.js

Use a fully qualified Node.js tag including major.minor.patch, not floating majors/minors.

Why this matters

Floating tags (e.g., 20, 20-alpine) can change behavior between builds, causing non-deterministic failures.

Side-by-side examples engineers can pattern-match during review.

Avoid

FROM node:20-alpine

Prefer

FROM node:20.11.1-alpine

Bad

FROM node:20

Good

FROM node:20.11.1

From the same buckets as this rule.

Critical
Pods must run as non-root with read-only root filesystem
Set securityContext.runAsNonRoot=true, runAsUser!=0, and readOnlyRootFilesystem=true on pods/containers.
infra-as-codesecurity-hardening+1
High
Add explicit environment variable checks
Validate required runtime env vars at container start via an entrypoint script; exit with a clear message on missing values.
config-environmentcontainer-docker-hygiene+1
High
Implement multi-stage builds for production
Use a builder stage for toolchains/dev deps and a minimal runtime stage that contains only runtime artifacts.
container-docker-hygienesecurity-hardening