Containers: the cheap, fast default

Build lab: a bare image forces the agent to install tools at run time with the network on. Order image layers so rarely changing ones sit below often changing ones, start warm from a ready image, keep state in the mount, and run non-root with the network off and no privileged flag. Catch a draft validator on a flipped COPY order, and read what Docker's build-cache docs and the sandboxing post do and do not say.

This Harness Engineering lesson is part of a paid plan. Sign in with a plan that includes this course to read it.