mcpField
C
container-image-hardening

container-image-hardening

github.com/securityskillsSecurity0168 installsUpdated 9w ago
Repository

About container-image-hardening

A skill for reviewing and hardening Dockerfiles and container images for production use. It checks build practices, vulnerabilities, runtime settings, and verification evidence, and produces a hardened Dockerfile and CI gate configuration.

Key features

  1. 01Review Dockerfile build practices
  2. 02Check images for vulnerabilities
  3. 03Harden runtime security settings
  4. 04Verify layers and non-root execution
  5. 05Produce scan reports and CI gates

Use cases

  1. 01Review a Dockerfile before release
  2. 02Add vulnerability checks to CI
  3. 03Reduce container runtime privileges

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/securityskills/skills --skill container-image-hardening

After installing, type/container-image-hardeningin Claude Code to confirm it loaded.

Details

From the project README

Container Image Hardening

Review and fix Dockerfiles and images for production safety.

Dockerfile Review Checklist

  • Base image: official, specific tag or digest, minimal variant (alpine, distroless, slim); never latest
  • Multi-stage builds: build toolchains (compilers, package managers) excluded from final image
  • Non-root user: USER directive with a dedicated UID; no sudo in image
  • No secrets: no ENV with credentials, no COPY .env, no secrets baked into layers (they persist even if deleted later)
  • Pinned dependencies: lockfiles used (npm ci, pip install -r requirements.txt with hashes)
  • Healthchecks defined; ENTRYPOINT over CMD for enforced init
  • Layer hygiene: combine apt operations and clean lists in one layer; .dockerignore covers .git, build artifacts

Scan and Gate

trivy image --severity HIGH,CRITICAL --exit-code 1 <image>
grype <image>
docker scout cves <image>
  • Fail CI on critical CVEs with available fixes
  • Track base image updates (renovate/dependabot for Dockerfiles)

Runtime Hardening

read_only: true
cap_drop: ["ALL"]
security_opt: ["no-new-privileges:true"]
tmpfs: [/tmp]
  • Resource limits set (CPU/memory) to blunt DoS
  • Root filesystem read-only; writable paths explicit tmpfs

Verification

  • docker history <image> — no secret-looking layers
  • dive <image> — image efficiency and wasted space
  • Run as the image user: docker run --rm <image> id shows non-root

Output

Hardened Dockerfile, scan report before/after, and CI gate configuration.

Comments

Markdown supported