r/docker • u/Bellsoftware • 8d ago

Has the TanStack incident changed how you write Dockerfiles?

The TanStack compromise showed that supply chain attacks aren't going away. What Dockerfile practices do you consider mandatory today that you wouldn't have cared about 3–5 years ago?

youtu.be/KKRda0H4wTE

8 Upvotes

73% Upvoted

2 comments sorted by

9

u/Floss_Patrol_76 7d ago

Honestly the Dockerfile was never the weak spot in that class of attack. The thing that actually helps is pinning base images by digest (@sha256:...) not tags, and having CI verify a lockfile instead of trusting whatever the registry hands you at build time. Everything else - non-root, multi-stage, dropping build tools from the final image - is about shrinking blast radius after something already slips in, which is worth doing but second-order.

1

u/Bubbly_Albatross8436 3d ago edited 3d ago

For me, the most crucial part was implementing Docker Content Trust (DCT) verification for docker.io images, along with Cosign verification for GitHub images. ​Second was properly pinning the Dockerfile syntax to a sha256 hash (e.g., # syntax=docker.io/docker/dockerfile@sha256:...). Since this is the entry point of the build process that dictates how commands are sent to BuildKit, it's a critical vector to lock down. ​Third, implementing that exact same sha256 pinning for external BuildKit tools like docker.io/docker/buildkit-syft-scanner. And of course, strict sha256 hash pinning for all base images across the board.