container-hardening

Original：🇺🇸 English

Translated

Secure Docker images and container runtime configurations. Implement non-root users, read-only filesystems, and security contexts. Use when building secure container images or hardening container deployments.

19installs

Sourcebagelhole/devops-security-agent-skills

Added on2026-08-22

NPX Install

npx skill4agent add bagelhole/devops-security-agent-skills container-hardening

SKILL.md Content

View Translation Comparison →

Container Hardening

Secure container images and runtime configurations.

When to Use This Skill

Use this skill when:

Building secure container images
Hardening container deployments
Meeting container security requirements
Implementing defense in depth

Dockerfile Security

dockerfile

# Use minimal base image
FROM alpine:3.18

# Don't run as root
RUN addgroup -g 1001 -S appgroup && \
    adduser -u 1001 -S appuser -G appgroup

# Copy with specific ownership
COPY --chown=appuser:appgroup . /app

# Remove unnecessary packages
RUN apk del --purge build-dependencies && \
    rm -rf /var/cache/apk/*

# Use non-root user
USER appuser

# Read-only filesystem support
WORKDIR /app

Runtime Security

bash

# Run with security options
docker run -d \
  --read-only \
  --tmpfs /tmp \
  --security-opt=no-new-privileges:true \
  --cap-drop=ALL \
  --cap-add=NET_BIND_SERVICE \
  --user 1001:1001 \
  myapp:latest

Kubernetes Security Context

yaml

apiVersion: v1
kind: Pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1001
    fsGroup: 1001
  containers:
  - name: app
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop: ["ALL"]

Image Scanning