mcpField
C
container-hardening

container-hardening

github.com/bagelholeSecurity1.2k438 installsUpdated 23w ago
Repository

About container-hardening

A security skill guide for hardening container images and runtime settings. It is intended for teams building or deploying containers and covers image choices, least-privilege runtime controls, Kubernetes security contexts, and scanning.

Key features

  1. 01Minimal base image guidance
  2. 02Non-root container setup
  3. 03Runtime security options
  4. 04Kubernetes security contexts
  5. 05Trivy image scanning

Use cases

  1. 01Hardening container images
  2. 02Reducing container runtime privileges
  3. 03Applying Kubernetes pod security settings
  4. 04Checking images for vulnerabilities

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/bagelhole/devops-security-agent-skills --skill container-hardening

After installing, type/container-hardeningin Claude Code to confirm it loaded.

Bundled filesreferences/container-security.md

Details

From the project README

Container Hardening

Secure container images and runtime configurations.

When to Use This Skill

Use this skill when:

  • Building secure container images
  • Hardening container deployments
  • Meeting container security requirements
  • Implementing defense in depth

Dockerfile Security

# Use minimal base image
FROM alpine:3.18

# Don't run as root
RUN addgroup -g 1001 -S appgroup && \
    adduser -u 1001 -S appuser -G appgroup

# Copy with specific ownership
COPY --chown=appuser:appgroup . /app

# Remove unnecessary packages
RUN apk del --purge build-dependencies && \
    rm -rf /var/cache/apk/*

# Use non-root user
USER appuser

# Read-only filesystem support
WORKDIR /app

Runtime Security

# Run with security options
docker run -d \
  --read-only \
  --tmpfs /tmp \
  --security-opt=no-new-privileges:true \
  --cap-drop=ALL \
  --cap-add=NET_BIND_SERVICE \
  --user 1001:1001 \
  myapp:latest

Kubernetes Security Context

apiVersion: v1
kind: Pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1001
    fsGroup: 1001
  containers:
  - name: app
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop: ["ALL"]

Image Scanning

# Scan with Trivy
trivy image --severity HIGH,CRITICAL myapp:latest

# Use distroless images
FROM gcr.io/distroless/static-debian11

Best Practices

  • Use minimal base images
  • Run as non-root user
  • Enable read-only filesystem
  • Drop all capabilities
  • Scan images regularly
  • Sign and verify images
  • Use secrets management

Related Skills

Comments

Markdown supported