Menu
Container hardening, image security, and Docker best practices. Use when building, scanning, or securing containers and images.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
| name | docker-security |
| description | Container hardening, image security, and Docker best practices. Use when building, scanning, or securing containers and images. |
| paths | **/Dockerfile*,**/docker-compose*,**/.dockerignore,**/docker-compose.yml,**/docker-compose.yaml,**/docker-bake* |
hadolint Dockerfiletrivy image <org>/<app>:<tag> — catch CVEs before registry pushsyft <org>/<app>:<tag> -o spdx-json > sbom.spdx.jsondive <org>/<app>:<tag> — identify bloat, leaked filesgcr.io/distroless/base:nonroot or cgr.io/chainguard/base:latestRUN useradd -m -u 1000 app && chown -R app:app /app → USER appdocker run --read-only --tmpfs /tmp --tmpfs /run <image>docker run --cap-drop=ALL --cap-add=NET_BIND_SERVICE <image>RUN --mount=type=secret (Docker 18.04+)services:
app:
image: <image>:<pinned-tag> # Never use latest in prod
user: "1000:1000"
read_only: true
cap_drop: [ALL]
cap_add: [NET_BIND_SERVICE]
tmpfs: [/tmp, /run]
security_opt:
- no-new-privileges:true
networks:
- internal
networks:
internal:
driver: bridge
driver_opts:
com.docker.network.bridge.enable_icc: "false" # Block inter-container comms
trivy image --scan-secrets <org>/<app>:<tag> # Leaked secrets in layers
grype <org>/<app>:<tag> # CVE + secret detection
gitleaks detect . # Pre-push secret scan
cosign sign <image>:<tag> # Sign (requires COSIGN_KEY env)
cosign verify --key cosign.pub <image>:<tag> # Verify on pull
trivy image --severity HIGH,CRITICAL --exit-code 1 <image>:<tag> # Gate in CI
crane manifest <image>:<tag> | jq . # Inspect remote manifest
cosign tree <image>:<tag> # Check provenance + attestations
docker run --security-opt apparmor=docker-default <image> # AppArmor profile
docker run -m 512m --cpus=1 <image> # Limit resources (DoS protection)
docker run -v /data:/data:ro <image> # Read-only volume mounts
docker run --security-opt no-new-privileges:true <image> # Block privilege escalation
# Verify storage driver: docker info | grep "Storage Driver" (should be overlay2)
# Stage 1: Build
FROM golang:1.21 AS builder
WORKDIR /app
COPY . .
RUN go build -o myapp .
# Stage 2: Runtime (distroless — no shell, no package manager)
FROM gcr.io/distroless/base:nonroot
COPY --from=builder /app/myapp /myapp
USER nonroot
ENTRYPOINT ["/myapp"]
latest tag in deployments — use commit SHA or semver.dockerignoreapt-get install && apt-get clean in single RUN layertrivy --exit-code 1 on CRITICAL)--privileged unless absolutely necessaryReference for 100+ installed CLI tools. Use when working with any CLI tool, searching files, processing data, managing containers, infrastructure, security scanning, or system monitoring.
Security scanning and vulnerability assessment workflows. Use when performing security audits, scanning for vulnerabilities, checking dependencies, or hardening systems.
Add a new CLI tool to the titan setup and make it usable immediately. Use when installing a new CLI tool, registering a tool in the setup script, updating the tool inventory, or when the user says "add tool", "new CLI tool", "register tool", "install X to titan". Also triggers on "I installed X", "add X to the setup", or any request to add a CLI tool to the workstation.
Git branching, commit, and PR conventions. Use when creating branches, making commits, or opening PRs.
Infrastructure as Code workflows with Terraform, Ansible, Docker, and Kubernetes. Use when provisioning, configuring, deploying, or managing infrastructure.
Transform files and folders into learning materials using NotebookLM. Actions: transform, convert, generate, create from files. Outputs: audio podcast, video explainer, slide deck, study guide, quiz, flashcards, infographic, mind map, briefing doc, report. Sources: PDF, text files, URLs, folders, subfolders. Features: batch processing, watermark removal, progress tracking, configurable granularity.