菜单
Build small, secure container images — pinned base, non-root user, multi-stage builds, no secrets in layers, minimal attack surface.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | docker-image-hardening |
| description | Build small, secure container images — pinned base, non-root user, multi-stage builds, no secrets in layers, minimal attack surface. |
| category | DevOps |
| tags | docker, containers, security, ci |
Writing or reviewing a Dockerfile for anything that ships.
latest. Prefer -slim / distroless.USER it; drop to it before CMD.COPY .env or bake tokens — pass at runtime / use a secret store. Layers are forever, even if a later layer deletes the file.--no-install-recommends, clean apt lists in the same RUN, .dockerignore the build context.docker history shows a secret or a huge dep layer → fix the Dockerfile, don't just squash.Write a blameless incident postmortem — timeline, impact, root cause, and concrete follow-ups, focused on systems not people.
Write clear, conventional git commit messages — type(scope): summary, imperative mood, a body that explains the why.
Control and query Home Assistant through the connector's call_service tool — REST API patterns, common domains, how to find entities before acting.
Design predictable REST APIs — noun resources, correct status codes, pagination, consistent errors, and versioning.
Handle API keys, tokens and passwords safely — store them in the vault, reference by name, never in chat, repo, memory, or code.
Diagnose slow queries and add the right indexes — read the query plan, index for filters/joins/sorts, avoid over-indexing.