Agent skill · security · sickn33
container-security-hardening
Harden Docker/container images and runtime deployments with secure base images, non-root users, CVE scanning, SBOM/signing, seccomp/AppArmor, and Kubernetes pod security controls. Use for Dockerfile security reviews, container CVEs, image scanning, distroless images, or production hardening.
Why this skill is useful
Provides specific guidelines and commands for hardening container security that the AI wouldn't reliably generate on its own.
What it needs
Requires cosign, grype, snyk, trivy installed locally. About 2k tokens when loaded. Last updated 2026-08-07. 44,571 stars on the source repository.
What this skill does
Container Security Hardening Skill A production-focused guide for building, scanning, and running containers securely — from Dockerfile authoring through runtime enforcement and supply chain integrity. --- Detailed Guide Read the detailed guide before executing this skill. It retains the complete procedure and reference material. Treat its safety, prerequisites, and validation requirements as mandatory. For focused work, load the relevant sections; for end-to-end work, read the guide completely. When to Use This Skill User mentions Docker security, container hardening, or Dockerfile security review User asks about distroless images, non-root containers, or read-only filesystems User wants to scan images for CVEs with Trivy, Grype, or Snyk User mentions seccomp, AppArmor, Linux capabilities, or runtime security User asks "is my Dockerfile secure?" or "how do I reduce my image attack surface?" User wants to sign/verify images with Cosign or generate SBOMs User asks about Kubernetes pod security, NetworkPolicy, or RBAC hardening User says "fix container CVEs" or "harden my container for production" When NOT to Use This Skill The user is primarily asking about GitHub Actions CI/CD → recommend github-actions-advanced The user needs general Docker usage help (not security) → recommend docker-expert The user is working with Kubernetes orchestration beyond security → recommend kubernetes-architect The user needs application-level security (SQL injection, XSS) → recommend api-security-best-practices --- Security Checklist Dockerfile [ ] Minimal base image (distroless, slim, or alpine — not full debian/ubuntu) [ ] Multi-stage build — no build tools, devDependencies, or compilers in runtime image [ ] Non-root USER declared before CMD/ENTRYPOINT [ ] Base image pinned to @sha256:... …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills sickn33/container-security-hardening--345372