There’s a lot wrong with this: you could be using the wrong version of code that has exploits, has a bug in it, or worse it could have malware bundled in on purpose—you just don’t know.

Keep Base Images Small

Node.js for example, it includes an extra 600MB of libraries you don’t need.

Use the Builder Pattern

#2: Container Internals

Use a Non-Root User Inside the Container

Make the File System Read-Only

One Process per Container

Don’t Restart on Failure. Crash Cleanly Instead.

Log Everything to stdout and stderr

Use the “Record” Option for Easier Rollbacks

Use Plenty of Descriptive Labels

Use Sidecars for Proxies, Watchers, Etc.

Don’t Use Sidecars for Bootstrapping!

Don’t Use :Latest or No Tag

Readiness and Liveness Probes are Your Friend

Don’t Use type: LoadBalancer

Type: Nodeport Can Be “Good Enough”

Use Static IPs They Are Free!

Map External Services to Internal Ones

Use Helm Charts

All Downstream Dependencies Are Unreliable

Use Weave Cloud

Make Sure Your Microservices Aren’t Too Micro

Use Namespaces to Split Up Your Cluster

Role-Based Access Control