| name | container-hardening |
| type | skill |
| description | Harden container images and Kubernetes workload security contexts — distroless, multi-stage, minimal attack surface. |
| related-rules | ["container-security.md","shift-left-policy.md"] |
| allowed-tools | Read, Write, Edit, Bash |
Skill: Container Hardening
Expertise: Minimal images, distroless, multi-stage builds, security context, Dockerfile best practices, Trivy scanning.
When to load
When building a new Dockerfile, hardening an existing image, failing Trivy scan, or setting up pod security contexts.
Hardened Dockerfile (Python example)
# ── Stage 1: Build (has build tools, not in final image) ──
FROM python:3.12-slim@sha256:<pinned-digest> AS builder
WORKDIR /app
COPY requirements.txt .
RUN pip install --user --no-cache-dir -r requirements.txt
# ── Stage 2: Runtime (minimal, no build tools) ───────────
FROM python:3.12-slim@sha256:<pinned-digest>
# Create non-root user
RUN groupadd -r appgroup --gid=1000 && \
useradd -r -g appgroup --uid=1000 --no-create-home appuser
WORKDIR /app
# Copy only built artifacts from builder
COPY --from=builder /root/.local /home/appuser/.local
COPY --chown=appuser:appgroup src/ ./src/
# Remove SETUID binaries (attack surface reduction)
RUN find / -perm /6000 -type f -exec chmod a-s {} \; 2>/dev/null || true
# Switch to non-root
USER 1000:1000
# Read-only filesystem friendly: temp dir for app writes
VOLUME ["/tmp"]
EXPOSE 8080
# Prefer exec form (handles signals correctly)
ENTRYPOINT ["python", "-m", "uvicorn", "src.main:app", "--host", "0.0.0.0", "--port", "8080"]
