By default, Docker containers execute processes under the root user. If an attacker exploits an application vulnerability (e.g. remote code execution or path traversal), they gain root privileges inside the container. Combined with any Linux kernel vulnerability or mounted volumes, this enables complete host system compromise. Always declare an unprivileged USER appuser before your CMD or ENTRYPOINT.

Multi-stage builds allow you to use multiple FROM instructions in a single Dockerfile. You can compile your application in a heavy builder stage containing Node.js, Go, or Maven toolchains, and then copy only the finalized compiled binaries into an ultra-lean runtime image (such as Alpine or Distroless). This reduces final container sizes from 1GB+ down to under 50MB and eliminates compiler attack surface.

The :latest tag is a moving target that updates upstream whenever upstream publishers push a new version. Builds performed on different days or by different developers can yield divergent runtime environments, breaking deterministic builds and introducing untested zero-day vulnerabilities silently into your production pipeline. Always pin exact semantic versions or SHA256 digest hashes.

In strict accordance with our Privacy First Architecture, ToolsAA computes all Dockerfile AST parsing, Hadolint rule matching, and score evaluations 100% inside your local web browser via modern Web APIs. No code, tokens, or Dockerfiles are ever uploaded or transmitted to any external server or telemetry service.

Writing CMD npm start uses shell form, which executes as /bin/sh -c as PID 1. The shell does not forward POSIX signals like SIGTERM to your node application, causing Docker to wait 10 seconds before forcibly issuing SIGKILL. Using JSON exec form CMD ["npm", "start"] runs the process directly as PID 1 for graceful zero-downtime terminations.