Harden Container Images and Runtime Security Posture

Provides a five-layer container-security hardening guide, worked in order for maximum leverage. Layer 1, Dockerfile hardening: minimal base images (distroless, slim, Alpine, or scratch for static binaries), multi-stage builds that keep compilers out of the runtime image, a non-root USER before CMD, base images pinned to a @sha256: digest rather than a mutable tag, BuildKit --mount=type=secret instead of baking secrets into ENV/ARG/RUN, exec-form ENTRYPOINT, and a HEALTHCHECK. Layer 2, image scanning: Trivy or Grype for CVEs with CI exit codes on HIGH/CRITICAL, Hadolint for Dockerfile lint, Syft/Trivy for CycloneDX/SPDX SBOM generation, and TruffleHog/trivy --scanners secret for leaked-secret detection. Layer 3, runtime security: a --read-only filesystem with scoped --tmpfs writable paths, --cap-drop ALL with capabilities re-added only when documented as required, --security-opt no-new-privileges:true, a custom seccomp profile built from a syscall audit via strace/sysdig, AppArmor, and resource limits. Layer 4, supply-chain security: keyless OIDC image signing and verification with Cosign, SBOM attestation, registry-native scanning compared across GHCR/ECR/GCP/ACR/Docker Hub, and Kyverno admission policies that block unsigned images. Layer 5, Kubernetes pod security: a full pod and container securityContext example, Pod Security Admission at the restricted level, default-deny NetworkPolicy plus scoped allow rules, least-privilege RBAC with no wildcard verbs, and Kyverno policies enforcing non-root and digest-pinned images.

# UNSAFE - tags are mutable; image can be silently overwritten (supply chain attack)
FROM node:20-slim

# SAFE - SHA256 digest is cryptographically immutable
FROM node:20-slim@sha256:a1b2c3d4e5f6789abcdef0123456789abcdef0123456789abcdef0123456789ab

Use it for Dockerfile security reviews, reducing image attack surface, fixing container CVEs, scanning or signing images, or hardening Kubernetes pod security. Before responding, the skill inspects the actual project state - finding Dockerfiles, checking for existing .trivyignore/.hadolint.yaml, grepping current FROM lines, and detecting Kubernetes manifests - rather than giving generic advice. It explicitly routes adjacent requests elsewhere: GitHub Actions CI/CD questions go to github-actions-advanced, general non-security Docker usage goes to docker-expert, Kubernetes orchestration beyond security goes to kubernetes-architect, and application-level security like SQL injection or XSS goes to api-security-best-practices. It also flags that seccomp and AppArmor are Linux-only - macOS/Windows Docker Desktop uses different enforcement mechanisms - and that its output is not a substitute for a formal security audit or penetration test.

Output is a full hardened multi-stage Dockerfile example (distroless runtime, digest-pinned, OCI labels, non-root nonroot:nonroot user, HEALTHCHECK), plus a four-part checklist covering Dockerfile, image scanning, runtime, and Kubernetes controls - 9, 5, 6, and 9 items respectively. Concrete CI wiring is given for GitHub Actions with SHA-pinned actions (checkout, Hadolint, Trivy with SARIF upload to the Security tab) and for Cosign keyless-signing plus SBOM attestation in the same pipeline. Kubernetes output includes a full pod spec with runAsNonRoot/readOnlyRootFilesystem/capabilities.drop: [ALL], a namespace-scoped default-deny-then-allow NetworkPolicy pair, a least-privilege Role/RoleBinding naming specific resources instead of wildcards, and three Kyverno ClusterPolicy examples (require non-root, require digest pinning, disallow privileged containers). A nine-row "Common Pitfalls & Fixes" table maps symptoms - image runs as root, a secret visible in docker history, an app crashing under --read-only, a K8s pod rejected by PSA - to root cause and fix.

Names the concrete tool for each layer: Trivy or Grype, paired with Syft, for CVE and SBOM scanning; Hadolint for Dockerfile linting; TruffleHog for secret scanning; Cosign/Sigstore for keyless image signing via OIDC; and Kyverno for Kubernetes admission policy enforcement. It compares registry-native scanning across GHCR (none built in, use Trivy in CI), AWS ECR (Inspector-based enhanced scanning), GCP Artifact Registry (Container Analysis, on by default), Azure ACR (Defender for Containers, Premium tier), and Docker Hub (limited on the free tier). Three bundled reference files go deeper: a base-image size/CVE trade-off comparison, a minimal seccomp syscall-allowlist template, and a full Kubernetes pod-security reference covering NetworkPolicy, RBAC, OPA/Kyverno, and service accounts.

Developers and platform engineers hardening a container image or its Kubernetes deployment - Dockerfile review, CVE remediation, image signing, or pod security - who want the concrete flags, policies, and CI wiring for each of the five security layers rather than general Docker or Kubernetes guidance.