Skip to main content
configure-container Container infrastructure: GHCR builds, Trivy/Grype scanning, devcontainer. Use when setting up multi-platform GHCR workflows or adding container scanning to CI.
Ir para a instalação Skills Marketplace Descubra e explore skills de IA criadas pela comunidade.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Mostrar detalhes do prompt Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
npx skills add https://github.com/laurigates/claude-plugins --skill configure-containerO comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.
Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.
Baixar Zip Baixando... Explorador de arquivos
2 arquivos Ocupações relacionadas SOC
Baseado na classificação ocupacional SOC
Mais deste repositório Install, configure and troubleshoot MCP servers. Use when adding/enabling servers, editing .mcp.json, fixing OAuth, or when a server runs stale code after an upstream fix.
FinOps snapshot — org billing, workflow stats, cache usage. Use when you want a high-level view of CI spending or workflow health before diving deeper.
GitHub Actions billing, workflow efficiency, and waste analysis at org or repo level. Use when investigating CI/CD costs, wasted runs, or optimizing triggers.
created "2025-12-16T00:00:00.000Z" modified "2026-06-18T00:00:00.000Z" reviewed "2026-06-01T00:00:00.000Z" description Container infrastructure: GHCR builds, Trivy/Grype scanning, devcontainer. Use when setting up multi-platform GHCR workflows or adding container scanning to CI. allowed-tools Glob, Grep, Read, Write, Edit, AskUserQuestion, TodoWrite, SlashCommand, WebSearch, WebFetch args [--check-only] [--fix] [--component <dockerfile|workflow|registry|scanning|devcontainer>] argument-hint [--check-only] [--fix] [--component <dockerfile|workflow|registry|scanning|devcontainer>] name configure-container
/configure:container
Check and configure comprehensive container infrastructure against project standards with emphasis on minimal images , non-root users , and security hardening .
When to Use This Skill
Use this skill when... Use another approach when... Auditing container infrastructure compliance (Dockerfile, workflows, scanning) Writing a Dockerfile from scratch (/configure:dockerfile) Checking multi-stage builds, non-root users, and security hardening Configuring Kubernetes deployments (/configure:skaffold) Setting up container build workflows with GHCR and multi-platform support Running vulnerability scans on a built image (Trivy CLI directly) Verifying .dockerignore, OCI labels, and base image versions Configuring devcontainer features for VS Code Adding Trivy/Grype scanning to CI pipelines Debugging container runtime issues (system-debugging agent)
Context
Dockerfiles: !find . -maxdepth 2 \( -name 'Dockerfile' -o -name 'Dockerfile.*' -o -name '*.Dockerfile' \)
Docker ignore: !find . -maxdepth 1 -name '.dockerignore'
Container workflows: !find . -path '*/.github/workflows/*' -maxdepth 3 \( -name '*container*' -o -name '*docker*' -o -name '*build*' \)
Devcontainer: !find . -path '*/.devcontainer/*' -maxdepth 2 -name 'devcontainer.json'
Skaffold: !find . -maxdepth 1 -name 'skaffold.yaml'
Package files: !find . -maxdepth 1 \( -name 'package.json' -o -name 'pyproject.toml' -o -name 'Cargo.toml' -o -name 'go.mod' \)
Project standards: !find . -maxdepth 1 -name '.project-standards.yaml'
Parameters
Parse from command arguments:
--check-only: Report compliance status without modifications (CI/CD mode)--fix: Apply fixes automatically without prompting--component <name>: Check specific component only (dockerfile, workflow, registry, scanning, devcontainer)
Security Philosophy
Minimal Attack Surface : Smaller images = fewer vulnerabilities. Use Alpine (~5MB) for Node.js, slim (~50MB) for Python.
Non-Root by Default : ALL containers MUST run as non-root users.
Multi-Stage Required : Separate build and runtime environments. Build tools and dev dependencies should NOT be in production images.
Execution Execute this container infrastructure compliance check:
Step 1: Detect container-related files Search for Dockerfile, workflow files, devcontainer config, and .dockerignore. Detect the project type (frontend, python, go, rust, infrastructure) from package files.
Step 2: Look up latest base image versions Use WebSearch or WebFetch to verify current versions before flagging outdated images:
Node.js Alpine images : Check Docker Hub for latest LTS Alpine tagsPython slim images : Check Docker Hub for latest slim tagsnginx Alpine : Check Docker Hub for latest Alpine tagsGitHub Actions : Check release pages for latest action versionsTrivy : Check aquasecurity/trivy-action releases
Step 3: Analyze each component Check each component against standards:
Check Standard Severity Exists Required for containerized projects FAIL if missing Multi-stage Required (build + runtime stages) FAIL if missing HEALTHCHECK Required for K8s probes FAIL if missing Non-root user REQUIRED (not optional) FAIL if missing .dockerignore Required WARN if missing .dockerignore Dockerfile* Use glob to exclude all Dockerfile variants from context WARN if only Dockerfile Base image version Latest stable (check Docker Hub) WARN if outdated Minimal base Alpine for Node, slim for Python WARN if bloated
Base Image Standards (verify latest before reporting):
Language Build Image Runtime Image Size Target Node.js node:24-alpine (LTS)nginx:1.30-alpine< 50MB Python python:3.14-slimpython:3.14-slim< 150MB Go golang:1.26-alpinescratch or alpine:3.23< 20MB Rust rust:1.96-alpinealpine:3.23< 20MB
Security Hardening Standards:
Check Standard Severity Non-root USER Required (create dedicated user) FAIL if missing Read-only FS --read-only or RO annotationINFO if missing No new privileges --security-opt=no-new-privilegesINFO if missing Drop capabilities --cap-drop=all + explicit --cap-addINFO if missing No secrets in image No ENV with sensitive data FAIL if found
Build Workflow Standards:
Check Standard Severity Workflow exists container-build.yml or similar FAIL if missing checkout action v4+ WARN if older build-push-action v6+ WARN if older Multi-platform linux/amd64,linux/arm64 WARN if missing Build caching GHA cache enabled WARN if missing Security scan Trivy/Grype in workflow WARN if missing id-token: writeRequired when provenance/SBOM configured WARN if missing Cache scope Explicit scope= for multi-image builds WARN if missing Scanner pinned Trivy/Grype action pinned by SHA (not @master) WARN if unpinned
Container Labels Standards (GHCR Integration):
Check Standard Severity org.opencontainers.image.sourceRequired - Links to repository WARN if missing org.opencontainers.image.descriptionRequired - Package description WARN if missing org.opencontainers.image.licensesRequired - SPDX license WARN if missing
Run /configure:dockerfile for detailed Dockerfile checks if needed.
Step 4: Generate compliance report Print a formatted compliance report:
Container Infrastructure Compliance Report
==============================================
Project Type: frontend (detected)
Component Status:
Dockerfile PASS
Build Workflow PASS
Registry Config PASS
Container Scanning WARN (missing)
Devcontainer SKIP (not required)
.dockerignore PASS
Dockerfile Checks:
Multi-stage 2 stages PASS
HEALTHCHECK Present PASS
Base images node:24, nginx PASS
Build Workflow Checks:
Workflow container-build.yml PASS
checkout v4 PASS
build-push-action v6 PASS
Multi-platform amd64,arm64 PASS
GHA caching Enabled PASS
Container Labels Checks:
image.source In metadata-action PASS
image.description Custom label set PASS
image.licenses Not configured WARN
Recommendations:
- Add org.opencontainers.image.licenses label to workflow
- Add Trivy or Grype vulnerability scanning to CI
Overall: 2 warnings, 1 info
If --check-only, stop here.
Step 5: Apply fixes (if --fix or user confirms)
Missing Dockerfile : Run /configure:dockerfile --fixMissing build workflow : Create from template in REFERENCE.md Missing scanning : Add Trivy scanning jobMissing .dockerignore : Create standard .dockerignore from REFERENCE.md Outdated actions : Update version numbers
Step 6: Update standards tracking Update .project-standards.yaml:
components:
container: "2025.1"
dockerfile: "2025.1"
container-workflow: "2025.1"
For detailed templates (Dockerfile, workflow, devcontainer, .dockerignore), see REFERENCE.md .
Agentic Optimizations Context Command Quick compliance check /configure:container --check-onlyAuto-fix all issues /configure:container --fixDockerfile only /configure:container --check-only --component dockerfileWorkflow only /configure:container --check-only --component workflowScanning only /configure:container --fix --component scanningFind all Dockerfiles find . -maxdepth 2 \( -name 'Dockerfile' -o -name 'Dockerfile.*' \) 2>/dev/null
Flags Flag Description --check-onlyReport status without offering fixes --fixApply fixes automatically --component <name>Check specific component only (dockerfile, workflow, registry, scanning, devcontainer)
Component Dependencies Container Infrastructure
├── Dockerfile (required)
│ └── .dockerignore (recommended)
├── Build Workflow (required for CI/CD)
│ ├── Registry config
│ └── Multi-platform builds
├── Container Scanning (recommended)
│ └── SBOM generation (optional)
└── Devcontainer (optional)
└── VS Code extensions
Notes
Multi-platform builds : Essential for M1/M2 Mac developers and ARM serversGHCR : GitHub Container Registry is preferred for GitHub-hosted projectsTrivy : Recommended scanner for comprehensive vulnerability detectionAlpine vs Slim : Use Alpine for Node.js/Go/Rust. Use slim (Debian) for Python (musl compatibility issues)Non-root is mandatory : Never run containers as root in productionVersion pinning : Always use specific version tags, never latest
See Also
/configure:dockerfile - Dockerfile-specific configuration/configure:workflows - GitHub Actions workflow configuration/configure:skaffold - Kubernetes development configuration/configure:security - Security scanning configuration/configure:all - Run all compliance checkscontainer-development skill - Container best practicesci-workflows skill - CI/CD workflow patterns 