ring-hardening-dockerfiles

name

ring:hardening-dockerfiles

description

Hardening Dockerfiles to reach Docker Hub Health Score grade A: enforcing a non-root USER, minimal/distroless multi-stage base images, no fixable critical/high CVEs, no AGPL-3.0 deps, and SBOM+provenance attestations. Use when creating a new Dockerfile, auditing one for security, or preparing images for Docker Hub publication. Skip when the project has no Dockerfile, changes are app-code-only, or you consume pre-built images.

Docker Security (Health Score Grade A)

When to use

• Creating a new Dockerfile
• Auditing an existing Dockerfile for security
• Preparing images for Docker Hub publication
• Docker Hub health score is below grade A

Skip when

• Project has no Dockerfile and none is being created
• Changes are application-code only with no Docker modifications
• Using pre-built images without custom Dockerfile

Related

Complementary: ring:implementing-tasks, ring:creating-helm-charts

General Dockerfile patterns: dev-team/docs/standards/devops.md#containers. This skill focuses on Docker Hub Health Score compliance.

Health Score Policies

#	Policy	Weight	Compliance
1	Default non-root user	Required	USER directive with non-root user
2	No fixable critical/high CVEs	Required	Distroless or Alpine, multi-stage
3	No high-profile vulnerabilities (CISA KEV)	Required	Up-to-date base images
4	No AGPL v3 licenses	Required