performing-container-image-hardening

name	performing-container-image-hardening
description	Use when this skill covers hardening container images by minimizing attack surface, removing unnecessary packages, implementing multi-stage builds, configuring non-root users, and applying CIS Docker Benchmark recommendations to produce secure production-ready images.
domain	cybersecurity
tags	["devsecops","cicd","container-hardening","docker","cis-benchmark","secure-sdlc"]
subdomain	devsecops
version	1.0.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04"]

Performing Container Image Hardening

Overview

Cybersecurity skill for performing container image hardening. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "performing container image hardening"

• "This skill covers hardening container images by minimizing attack surface, remov"

• When building production container images that need minimal attack surface

• When compliance requires CIS Docker Benchmark adherence for container configurations

• When reducing image size to minimize vulnerability exposure from unused packages

• When implementing defense-in-depth for containerized workloads

• When migrating from fat base images to distroless or minimal images

Do not use for runtime container security monitoring (use Falco), for host-level Docker daemon hardening (use CIS Docker Benchmark host checks), or for container orchestration security (use Kubernetes security scanning).

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Docker or BuildKit for multi-stage builds
• Base image options: distroless, Alpine, slim, or scratch
• Container scanning tool (Trivy) for validation
• CIS Docker Benchmark reference

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v  IOC_PATTERNS.items()}