| name | container-hardening |
| description | Secure Docker images and container runtime configurations. Implement non-root users, read-only filesystems, and security contexts. Use when building secure container images or hardening container deployments. Use when this capability is needed. |
| metadata | {"author":"bagelhole"} |
Container Hardening
Secure container images and runtime configurations.
When to Use This Skill
Use this skill when:
- Building secure container images
- Hardening container deployments
- Meeting container security requirements
- Implementing defense in depth
Dockerfile Security
# Use minimal base image
FROM alpine:3.18
# Don't run as root
RUN addgroup -g 1001 -S appgroup && \
adduser -u 1001 -S appuser -G appgroup
# Copy with specific ownership
COPY --chown=appuser:appgroup . /app
# Remove unnecessary packages
RUN apk del --purge build-dependencies && \
rm -rf /var/cache/apk/*
# Use non-root user
USER appuser
# Read-only filesystem support
WORKDIR /app
Runtime Security
docker run -d \
--read-only \
--tmpfs /tmp \
--security-opt=no-new-privileges:true \
--cap-drop=ALL \
--cap-add=NET_BIND_SERVICE \
--user 1001:1001 \
myapp:latest
Kubernetes Security Context
apiVersion: v1
kind: Pod
spec:
securityContext:
runAsNonRoot: true
runAsUser: 1001
fsGroup: 1001
containers:
- name: app
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities:
drop: ["ALL"]
Image Scanning
trivy image --severity HIGH,CRITICAL myapp:latest
FROM gcr.io/distroless/static-debian11
Best Practices
- Use minimal base images
- Run as non-root user
- Enable read-only filesystem
- Drop all capabilities
- Scan images regularly
- Sign and verify images
- Use secrets management
Related Skills
Source: bagelhole/devops-security-agent-skills — distributed by TomeVault.
