← LeaderboardThe Skill Leaderboard

container-hardening

Secure Docker images and container runtime configurations. Implement non-root users, read-only filesystems, and security contexts. Use when building secure container images or hardening container deployments.

Published by BagelHole ↗BagelHole/DevOps-Security-Agent-Skills

Try your first task

Review one container's security settings

Start a fresh conversation.

Use the container-hardening skill to review my Dockerfile and container runtime configuration. Identify the three most useful improvements involving a non-root user, a read-only filesystem, Linux capabilities, or no-new-privileges. Show proposed configuration changes and explain any writable-directory requirements; do not build or run the container.

Required inputs

  • The Dockerfile and current container runtime configuration.
  • Required application ports and writable directories.

Suggested template by Skill Leaderboard, grounded in the linked source. Task evidence ↗

SKILL.md

name: container-hardeningdescription: Secure Docker images and container runtime configurations. Implement non-root users, read-only filesystems, and security contexts. Use when building secure container images or hardening container deployments.license: MITmetadata:   author: devops-skills  version: "1.0"

Container Hardening

Secure container images and runtime configurations.

When to Use This Skill

Use this skill when:

  • Building secure container images
  • Hardening container deployments
  • Meeting container security requirements
  • Implementing defense in depth

Dockerfile Security

# Use minimal base image
FROM alpine:3.18

# Don't run as root
RUN addgroup -g 1001 -S appgroup && \
    adduser -u 1001 -S appuser -G appgroup

# Copy with specific ownership
COPY --chown=appuser:appgroup . /app

# Remove unnecessary packages
RUN apk del --purge build-dependencies && \
    rm -rf /var/cache/apk/*

# Use non-root user
USER appuser

# Read-only filesystem support
WORKDIR /app

Runtime Security

# Run with security options
docker run -d \
  --read-only \
  --tmpfs /tmp \
  --security-opt=no-new-privileges:true \
  --cap-drop=ALL \
  --cap-add=NET_BIND_SERVICE \
  --user 1001:1001 \
  myapp:latest

Kubernetes Security Context

apiVersion: v1
kind: Pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1001
    fsGroup: 1001
  containers:
  - name: app
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop: ["ALL"]

Image Scanning

# Scan with Trivy
trivy image --severity HIGH,CRITICAL myapp:latest

# Use distroless images
FROM gcr.io/distroless/static-debian11

Best Practices

  • Use minimal base images
  • Run as non-root user
  • Enable read-only filesystem
  • Drop all capabilities
  • Scan images regularly
  • Sign and verify images
  • Use secrets management

Related Skills