domains / families / security / container-security-hardening

container-security-hardening

authentic

Harden Docker/container images and runtime deployments with secure base images, non-root users, CVE scanning, SBOM/signing, seccomp/AppArmor, and Kubernetes pod security controls. Use for Dockerfile security reviews, container CVEs, image scanning, distroless images, or production hardening.

When to use

• User mentions Docker security, container hardening, or Dockerfile security review
• User asks about distroless images, non-root containers, or read-only filesystems
• User wants to scan images for CVEs with Trivy, Grype, or Snyk
• User mentions seccomp, AppArmor, Linux capabilities, or runtime security
• User asks "is my Dockerfile secure?" or "how do I reduce my image attack surface?"
• User wants to sign/verify images with Cosign or generate SBOMs
• User asks about Kubernetes pod security, NetworkPolicy, or RBAC hardening
• User says "fix container CVEs" or "harden my container for production"

When not to use

• The user is primarily asking about GitHub Actions CI/CD → recommend `github-actions-advanced`
• The user needs general Docker usage help (not security) → recommend `docker-expert`
• The user is working with Kubernetes orchestration beyond security → recommend `kubernetes-architect`
• The user needs application-level security (SQL injection, XSS) → recommend `api-security-best-practices`
• Use this skill only when the task clearly matches the scope described above.
• Do not treat the output as a substitute for environment-specific penetration testing or a formal security audit.
• Seccomp profiles and AppArmor are Linux-only; macOS/Windows Docker Desktop uses different mechanisms.
• Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.

Skill page

Source