How do you keep container images small and secure?

Use multi stage builds so compilers and build dependencies never reach the final image, start from a minimal base such as distroless or slim, and run as a non root user. Order layers so dependency installation caches separately from source, add a .dockerignore, pin base images by digest, and scan on build. Never pass secrets as build arguments, because they persist in the layer history.

For size, the two things that do the heavy lifting are multi stage builds and layer ordering. Build in a full image with the toolchain, then copy just the compiled output into a minimal runtime, which typically takes an image from several hundred megabytes to tens. Ordering matters because the dependency install should be its own layer above the source copy, otherwise every code change invalidates the cache and rebuilds everything. A .dockerignore stops the local git directory and node modules being sent to the daemon at all. For security, I run as a non root user with a read only root filesystem where the app allows it, pin the base image by digest so a rebuild is reproducible, and rebuild regularly so base patches land rather than pinning and forgetting. Scanning runs in the pipeline and fails on fixable high severity findings, and we publish an SBOM with the image so we can answer the which services use this library question in minutes when the next big advisory lands. Secrets never go in build args; they are visible in the history.