Secure Docker CI/CD Pipeline Checklist & Toolkit

What's Inside

• 📦Master Pipeline Checklist — 50+ items across all 6 stages, with difficulty tags (Quick Win / Moderate / Advanced) and a "why it matters" for every line
• 📦Secrets Decision Tree — choose between Docker Secrets, GitHub Actions Secrets, Doppler/Vault/AWS SM, or encrypted .env — plus a 10-item audit for existing repos
• 📦Quick Reference Guide — scanner comparison table (Trivy, Grype, Snyk, Clair), 8 common failure modes with specific fixes, and a First 30 Minutes onboarding path
• 📦GitHub Actions Workflow — build → Trivy scan → push to GHCR → SSH deploy with secrets injection and post-deploy health check (SHA-pinned throughout)
• 📦Rollback Workflow — manual or automatic, rolls back to last stable image tag and verifies health
• 📦Hardened Dockerfile Template — non-root user, SHA-pinned base image, dropped capabilities, OCI labels, multi-stage build
• 📦Trivy Config File — correct scanners key for v0.38+, severity thresholds, CVE acceptance registry template
• 📦Hardened .dockerignore — annotated with the reason each entry matters