Production checklist
Docker production checklist: 5 checks before launch
5 checks for running Docker in production: 1 must-do, 3 should-dos and 1 good-to-have. Each one says why it matters, how to verify it and where the docs are.
Updated . Every check links the vendor’s own docs.
Must do (1)
Don’t bake secrets into images; use build secrets and runtime env
Anything in an image layer can be pulled out by whoever can pull the image.
Verify from the command line
Look through the image’s layers and environment; a pass shows no keys, tokens or passwords.
docker history --no-trunc <image> docker image inspect <image> --format '{{json .Config.Env}}'
Should do (3)
Run as a non-root user and pin base image versions
Limits a container escape and keeps builds reproducible.
Verify from the command line
The image should run as a non-root user (not empty, root or 0), and FROM lines should name a version tag or digest, not latest.
docker image inspect <image> --format '{{.Config.User}}'Add a
.dockerignorethat excludes.env,.gitand local build outputEverything in the build context can end up in an image layer, secrets included.
Verify from the command line
.dockerignore lists .env*, .git and local build output, and the running image has no .env file.
docker run --rm <image> ls -a /app
Scan images for known vulnerabilities in CI
Base images collect CVEs between rebuilds.
Verify from the command line
CI fails the build on critical or high findings in the final image.
docker scout cves <image>
Good to have (1)
Use a multi-stage build so the final image has no compilers or dev dependencies
Fewer packages in the image means fewer vulnerabilities and a smaller attack surface.
Check the config
The Dockerfile has a build stage and a final stage that copies only the build output (no compilers, dev dependencies or source maps).
FROM node:<version> AS build # …build… FROM node:<version>-slim COPY --from=build /app/dist ./dist
Get the checklist for your whole stack
Design your stack or map your repo in StackPrism, and the Improve panel lists the checks for every technology on it and keeps track of what you’ve done. Building with an AI app builder? Start with the vibe coding checklist.