configure-container

Container infrastructure: GHCR builds, Trivy/Grype scanning, devcontainer. Use when setting up multi-platform GHCR workflows or adding container scanning to CI.

설치로 이동

저장소: laurigates/claude-plugins
최근 소스 활동: 2026년 6월 18일 06:18
감지된 SKILL.md 언어: 영어
스타: 49
포크: 7

설치 방법

기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.

소스 파일 검토

설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.

검색으로 돌아가기 설치로 돌아가기

created	"2025-12-16T00:00:00.000Z"
modified	"2026-06-18T00:00:00.000Z"
reviewed	"2026-06-01T00:00:00.000Z"
description	Container infrastructure: GHCR builds, Trivy/Grype scanning, devcontainer. Use when setting up multi-platform GHCR workflows or adding container scanning to CI.
allowed-tools	Glob, Grep, Read, Write, Edit, AskUserQuestion, TodoWrite, SlashCommand, WebSearch, WebFetch
args	[--check-only] [--fix] [--component <dockerfile\|workflow\|registry\|scanning\|devcontainer>]
argument-hint	[--check-only] [--fix] [--component <dockerfile\|workflow\|registry\|scanning\|devcontainer>]
name	configure-container

/configure:container

Check and configure comprehensive container infrastructure against project standards with emphasis on minimal images, non-root users, and security hardening.

When to Use This Skill

Use this skill when...	Use another approach when...
Auditing container infrastructure compliance (Dockerfile, workflows, scanning)	Writing a Dockerfile from scratch (`/configure:dockerfile`)
Checking multi-stage builds, non-root users, and security hardening	Configuring Kubernetes deployments (`/configure:skaffold`)
Setting up container build workflows with GHCR and multi-platform support	Running vulnerability scans on a built image (Trivy CLI directly)
Verifying `.dockerignore`, OCI labels, and base image versions	Configuring devcontainer features for VS Code
Adding Trivy/Grype scanning to CI pipelines	Debugging container runtime issues (system-debugging agent)

Context

Dockerfiles: !find . -maxdepth 2 \( -name 'Dockerfile' -o -name 'Dockerfile.*' -o -name '*.Dockerfile' \)
Docker ignore: !find . -maxdepth 1 -name '.dockerignore'
Container workflows: !find . -path '*/.github/workflows/*' -maxdepth 3 \( -name '*container*' -o -name '*docker*' -o -name '*build*' \)
Devcontainer: !find . -path '*/.devcontainer/*' -maxdepth 2 -name 'devcontainer.json'
Skaffold: !find . -maxdepth 1 -name 'skaffold.yaml'
Package files: !find . -maxdepth 1 \( -name 'package.json' -o -name 'pyproject.toml' -o -name 'Cargo.toml' -o -name 'go.mod' \)
Project standards: !find . -maxdepth 1 -name '.project-standards.yaml'

Parameters

Parse from command arguments:

--check-only: Report compliance status without modifications (CI/CD mode)
--fix: Apply fixes automatically without prompting
--component <name>: Check specific component only (dockerfile, workflow, registry, scanning, devcontainer)

Security Philosophy

Minimal Attack Surface: Smaller images = fewer vulnerabilities. Use Alpine (~5MB) for Node.js, slim (~50MB) for Python.

Check	Standard	Severity
Exists	Required for containerized projects	FAIL if missing
Multi-stage	Required (build + runtime stages)	FAIL if missing
HEALTHCHECK	Required for K8s probes	FAIL if missing
Non-root user	REQUIRED (not optional)	FAIL if missing
.dockerignore	Required	WARN if missing
.dockerignore `Dockerfile*`	Use glob to exclude all Dockerfile variants from context	WARN if only `Dockerfile`
Base image version	Latest stable (check Docker Hub)	WARN if outdated
Minimal base	Alpine for Node, slim for Python	WARN if bloated

Language	Build Image	Runtime Image	Size Target
Node.js	`node:24-alpine` (LTS)	`nginx:1.30-alpine`	< 50MB
Python	`python:3.14-slim`	`python:3.14-slim`	< 150MB
Go	`golang:1.26-alpine`	`scratch` or `alpine:3.23`	< 20MB
Rust	`rust:1.96-alpine`	`alpine:3.23`	< 20MB

Check	Standard	Severity
Non-root USER	Required (create dedicated user)	FAIL if missing
Read-only FS	`--read-only` or RO annotation	INFO if missing
No new privileges	`--security-opt=no-new-privileges`	INFO if missing
Drop capabilities	`--cap-drop=all` + explicit `--cap-add`	INFO if missing
No secrets in image	No ENV with sensitive data	FAIL if found

Check	Standard	Severity
Workflow exists	container-build.yml or similar	FAIL if missing
checkout action	v4+	WARN if older
build-push-action	v6+	WARN if older
Multi-platform	linux/amd64,linux/arm64	WARN if missing
Build caching	GHA cache enabled	WARN if missing
Security scan	Trivy/Grype in workflow	WARN if missing
`id-token: write`	Required when provenance/SBOM configured	WARN if missing
Cache scope	Explicit `scope=` for multi-image builds	WARN if missing
Scanner pinned	Trivy/Grype action pinned by SHA (not `@master`)	WARN if unpinned

Check	Standard	Severity
`org.opencontainers.image.source`	Required - Links to repository	WARN if missing
`org.opencontainers.image.description`	Required - Package description	WARN if missing
`org.opencontainers.image.licenses`	Required - SPDX license	WARN if missing

Container Infrastructure Compliance Report
==============================================
Project Type: frontend (detected)

Component Status:
  Dockerfile              PASS
  Build Workflow          PASS
  Registry Config         PASS
  Container Scanning      WARN (missing)
  Devcontainer           SKIP (not required)
  .dockerignore          PASS

Dockerfile Checks:
  Multi-stage             2 stages          PASS
  HEALTHCHECK             Present           PASS
  Base images             node:24, nginx    PASS

Build Workflow Checks:
  Workflow                container-build.yml PASS
  checkout                v4                PASS
  build-push-action       v6                PASS
  Multi-platform          amd64,arm64       PASS
  GHA caching             Enabled           PASS

Container Labels Checks:
  image.source            In metadata-action PASS
  image.description       Custom label set  PASS
  image.licenses          Not configured    WARN

Recommendations:
  - Add org.opencontainers.image.licenses label to workflow
  - Add Trivy or Grype vulnerability scanning to CI

Overall: 2 warnings, 1 info

components:
  container: "2025.1"
  dockerfile: "2025.1"
  container-workflow: "2025.1"

Context	Command
Quick compliance check	`/configure:container --check-only`
Auto-fix all issues	`/configure:container --fix`
Dockerfile only	`/configure:container --check-only --component dockerfile`
Workflow only	`/configure:container --check-only --component workflow`
Scanning only	`/configure:container --fix --component scanning`
Find all Dockerfiles	`find . -maxdepth 2 \( -name 'Dockerfile' -o -name 'Dockerfile.*' \) 2>/dev/null`

Container Infrastructure
├── Dockerfile (required)
│   └── .dockerignore (recommended)
├── Build Workflow (required for CI/CD)
│   ├── Registry config
│   └── Multi-platform builds
├── Container Scanning (recommended)
│   └── SBOM generation (optional)
└── Devcontainer (optional)
    └── VS Code extensions