Containers & Kubernetes Agent Skills

Create and apply Kubernetes NetworkPolicies to enforce pod-level network segmentation, restrict traffic between pods and namespaces, and block access to cloud metadata endpoints.

Deploys and manages Falco YAML rules for runtime threat detection in containers and Kubernetes, monitoring syscalls for shell spawns, file tampering, network anomalies, and privilege escalation. Parses Falco alerts for incident response.

Find over-permissive RBAC roles and service-account token abuse paths in Kubernetes using kubectl auth can-i, rbac-police, kubectl-who-can, and rakkess during authorized cluster security reviews.

Write and deploy Falco rules with the modern eBPF driver to detect container escape, namespace abuse, privileged mounts, and anomalous syscalls at runtime in Kubernetes and Docker.

Enforce Pod Security Standards (Privileged, Baseline, Restricted) in Kubernetes 1.25+ using the Pod Security Admission controller with namespace labels and compliant pod specs.

Enforce Kubernetes Pod Security Standards at the namespace level using the built-in admission controller, with support for baseline and restricted profiles.

Assess the security posture of Kubernetes etcd clusters by evaluating encryption at rest, TLS configuration, access controls, backup encryption, and network isolation.

Detect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies.

Deploy Aqua Security's Trivy scanner to detect vulnerabilities, misconfigurations, secrets, and license issues in container images across CI/CD pipelines and registries.

Implement Kubernetes network segmentation using Calico NetworkPolicy and GlobalNetworkPolicy for zero-trust pod-to-pod communication.

Enforce Kubernetes admission policies using OPA Gatekeeper with ConstraintTemplates, Rego rules, and the Gatekeeper policy library.

Enforce organizational security policies across Kubernetes clusters and CI/CD pipelines using Open Policy Agent (OPA) and Gatekeeper, including writing Rego policies, deploying admission controllers, and testing policies locally.

Enforce Kubernetes network segmentation using Calico CNI network policies and global network policies to control pod-to-pod traffic, restrict egress, and implement zero-trust microsegmentation.

Audit Kubernetes cluster security posture against CIS benchmarks using kube-bench with automated checks for control plane, worker nodes, and RBAC.

Sign and verify container image provenance using Sigstore Cosign with keyless OIDC-based signing, attestations, and Kubernetes admission enforcement.

Reduce container attack surface by building application images on Google distroless base images that contain only the application runtime with no shell, package manager, or unnecessary OS utilities.

Scaffolds an isolated cloud development box per agent using Crabbox and Daytona, with its own database, dev server, and in-box browser for parallel testing without port or state collisions.

Creates Dockerfiles, configures CI/CD pipelines, writes Kubernetes manifests, and generates Terraform/Pulumi infrastructure templates for deployment automation, GitOps, and incident response.

Create and manage Kubernetes workloads with declarative YAML manifests, covering deployments, networking, security, storage, Helm charts, and troubleshooting.

Design and build hosted agent infrastructure with sandboxed execution, warm pools, session persistence, and multiplayer collaboration.

Train large language models (7B-70B+) with RLHF using PPO, GRPO, DPO, and other algorithms, accelerated by Ray and vLLM for distributed multi-GPU setups.

Evaluates LLMs across 100+ benchmarks from 18+ harnesses (MMLU, HumanEval, GSM8K, safety, VLM) with multi-backend execution on local Docker, Slurm HPC, or cloud platforms.

Deploy a production self-hosted n8n instance on a fresh Linux VM over SSH, using Docker Compose behind a Caddy reverse proxy with automatic HTTPS.

Provides guidance on enabling and optimizing GKE Cluster Autoscaler, including Node Auto Provisioning, troubleshooting scale-up/down issues, and best practices for capacity management.

Orchestrates Gemini 3 Flash to audit Linux Kernel patches for memory safety, detect cost drifts in Terraform plans, and generate hardened Kubernetes security contexts.

Authorized security assessment for cloud, container, and Kubernetes environments covering metadata SSRF, IAM misconfigurations, container escape paths, and cluster RBAC review.

Specialized CTF sandbox skill for analyzing prompt-to-tool chains, deployment drift, and supply-chain provenance in cloud, container, and CI/CD environments.

Provides links to ArgoCD documentation and videos for running database clusters and GitOps deployments.

Generates and validates Kubernetes Helm charts using helm template and helm lint, with support for values schema generation and chart dependency resolution.

Builds machine and container images with HashiCorp Packer, including Docker images locally without cloud resources.

Generates production-grade Kubernetes manifests including Deployments with probes and security contexts, Services, Ingress with TLS, HPA, PDB, NetworkPolicy, ConfigMaps, and Secrets, with optional Helm charts, Kustomize overlays, Istio mesh, and ArgoCD GitOps.

Detects the project stack and generates production-ready multi-stage Dockerfiles with compose services, .dockerignore, non-root users, health checks, layer caching, and optional dev hot-reload profiles.

Sets up and runs OSS-Fuzz fuzzing harnesses locally, builds project images, and generates coverage reports.

Provides Docker and Docker Compose patterns for local development, container security, networking, volume strategies, and multi-service orchestration.

Provides Docker guidance covering images, Compose, networking, volumes, debugging, and production hardening, with commands and best practices for stable environments.

Guides Docker CLI workflows for building, running, inspecting, and cleaning up containers and images, with safety guidance for destructive commands.