NEW JOB OPPORTUNITIES
- Junior DevOps Engineer, Remote
- Junior DevOps Engineer, Hybrid
- DevOps Engineer, Microsoft, Remote
For more opportunities, click here to open the full post (free)
FROM BLOATED TO BULLETPROOF
When I scanned one of my early Python containers, I nearly spit out my coffee:
🔍 750+ low, 500+ medium, 93 high, and 5 critical vulnerabilities.
And the image was over 1GB.
Just by changing the base image, I eliminated 99% of those vulnerabilities. But I didn’t stop there.
What follows is a concise guide to optimize your container images for security and size.
🧠 1. Choose the right base image
Most devs reach for python:latest out of habit. But that image is bloated and loaded with vulnerabilities.
Switching to python:3.13-alpine dropped our image to ~113MB and removed hundreds of CVEs instantly.
*It’s not always possible to use Alpine, but you should always try.*
🪜 2. Use multi-stage builds for clean final images
We install everything in a separate stage, then copy only the runtime environment: no pip, no cache, no bloat.
This technique slashed build time, cut attack surface, and made our containers production-ready.
(We deep-dive this in the masterclass with examples.)
🛠️ 3. Run only what you need
I recommend using UV to manage your packages in Python. By building your Python package using uv sync you can keep it very lean by excluding development dependencies.
Finally, you just copy the .venv into your final image:
COPY –from=builder –chown=app:app /app/.venv /app/.venvOur final image includes just the binary and dependencies. No package managers, no tooling.
That one move cut dozens of MBs and made our security scanner smile.
💡 Final Result:
- ✅ 55MB image (down from 1GB)
- ✅ 99% fewer CVEs
- ✅ Faster deploys, reduced cloud costs, hardened containers
If you’re building for production, this is the standard.
If you only include exactly what you need at run time, you reduce your attack surface and the image size. This leads to more secure deployments and much faster deployment times. I go much deeper into many more of these techniques in my new DevOps Masterclass. Click here if you want to learn more.
That’s it for this week.
Keep automating,
Mischa
P.S. Don’t just learn Docker tricks, master the entire pipeline. Inside KubeCraft, I’ll show you how to build a complete, production-grade CI/CD system based on GitOps. From code to cluster.
👉 Click here to join and start building it today