Question
A cloud engineer is reviewing the following Dockerfile to deploy a Python web application:
```dockerfile
FROM cgr.dev/chainguard/python:latest
WORKDIR /myapp
COPY main.py ./
ENTRYPOINT ["python", "/myapp/main.py"]
```
Which of the following changes should the engineer make to the file to improve container security?
- A. Add the instruction USER nonroot. Correct
- B. Change the version from latest to 3.11.
- C. Remove the ENTRYPOINT instruction.
- D. Ensure myapp/main/py is owned by root.
Explanation
Adding a USER instruction so the container runs as a non-root user limits what an attacker can do if the application is compromised, following the principle of least privilege. Pinning the image version improves reproducibility rather than security posture. Removing ENTRYPOINT would stop the application from starting, and making the script owned by root does not reduce the privileges the process runs with.
