Your mission is to turn a bloated CVE-infested container image into a low-noise image with low vulnerability exposure and clear operational posture. You have 45 minutes before the explosive attack hits. Mission possible!
This session provides a straight path towards building more secure and maintainable Java container images. We will identify the key culprits such as stale dependencies, outdated base, lack of provenance, and excessive privileges. Then, we will draft a step-by-step plan to:
- Pick a minimal and well-maintained base image,
- Shrink privileges,
- Prove provenance with version pinning, signatures and SBOMs,
- Scan and classify with CVSS rules to cut noise and fix what’s exploitable,
- Automatically monitor for updates with Dependabot/Renovate.

Expect a before/after scan comparison, copy-and-paste Dockerfile instructions, verification checklist, and a clear and reproducible path towards hardened Java container images that provide an impenetrable lock-box for your applications.