docker-hardening

name	docker-hardening
description	Reviews Dockerfiles and container configuration for security, reproducibility, image size, runtime permissions, and deployment reliability.

Docker Hardening

Use this skill when reviewing or improving Dockerfiles, Compose files, container runtime flags, or image build workflows.

Inputs

• Dockerfile, compose file, build logs, image metadata, deployment environment, and application runtime requirements

Steps

1. Review base image choice, version pinning, architecture, and maintenance status.
2. Check build reproducibility: pinned dependencies, deterministic package install, cache hygiene, and lockfile use.
3. Reduce image size where it also improves reliability or security: multi-stage builds, minimal runtime dependencies, and cleaned package caches.
4. Review runtime security: non-root user, file permissions, capabilities, read-only filesystem, secrets handling, exposed ports, and health checks.
5. Check supply-chain risk: curl-pipe-shell, unsigned downloads, mutable tags, and unverified artifacts.
6. Validate operational readiness: signals, graceful shutdown, logging, startup command, environment variables, and resource expectations.

Output

Return:

• Container risk summary
• Recommended Dockerfile/config changes
• Security hardening checklist
• Reproducibility and size notes
• Validation commands such as build, run, scan, or smoke test

Guidelines

• Do not optimize image size at the expense of clarity or correctness.
• Prefer pinned, maintained base images.
• Keep production runtime separate from build tooling when practical.