Results for “container-drift”

Assess and migrate cross-cloud workloads to Azure with reports and code conversion. Supports Lambda to Functions, Beanstalk/Heroku/App Engine to App Service, Fargate/Kubernetes/Cloud Run/Spring Boot to Container Apps.

Detect container escape attempts using runtime security tools like Falco, Sysdig, and custom seccomp/audit rules.

Exploit privileged pods, host mounts, runC CVEs, and exposed Docker sockets to break out of a container and reach the underlying host during authorized container-security assessments.

`task-agent`/`review-agent`: use when image layers, build context, runtime user, secrets, health checks, shutdown, or provenance change; skip when container behavior is unaffected.

Provides guidance and best practices for working with containerd, covering setup, configuration, deployment, and troubleshooting.

C4 Container Level: System Deployment

Write and deploy Falco rules with the modern eBPF driver to detect container escape, namespace abuse, privileged mounts, and anomalous syscalls at runtime in Kubernetes and Docker.

Detect container escape attempts in real-time using Falco runtime security rules that monitor syscalls, file access, and privilege escalation.

Provides expertise in containerization technology, covering container creation, orchestration integration, security hardening, and operational best practices for production workloads.

Docker and container development agent skill and plugin for Dockerfile optimization, docker-compose orchestration, multi-stage builds, and container security hardening. Use when: user wants to optimize a Dockerfile, create or improve docker-compose configurations, implement multi-stage builds, audit container security, reduce image size, or follow container best practices. Covers build performance, layer caching, secret management, and production-ready container patterns.

Docker and container development agent skill and plugin for Dockerfile optimization, docker-compose orchestration, multi-stage builds, and container security hardening. Use when: user wants to optimize a Dockerfile, create or improve docker-compose configurations, implement multi-stage builds, audit container security, reduce image size, or follow container best practices. Covers build performance, layer caching, secret management, and production-ready container patterns.

Integrate Trivy vulnerability scanning into CI/CD pipelines to detect container image CVEs, Dockerfile misconfigurations, and enforce severity-based quality gates.

Audits Kubernetes pods for container escape vectors by analyzing privileged mode, dangerous capabilities, host namespace sharing, and writable hostPath mounts using the Kubernetes Python client.

Detect container escape attempts using Falco, seccomp, and auditd, with rules for privileged containers, Docker socket access, and kernel module loading.

A container image is an attack surface you chose.

Hierarchical coordination and drift detection with frequent checkpoints, shared memory coherence validation, role specialization enforcement, and short task cycles.

Drive end-to-end Convex production migrations with explicit safety gates for destructive operations and cleanup.

Terraform infrastructure-as-code workflow patterns: state and environments, module design, safe plan/apply, drift control, and CI guardrails

Docker

Implements container security with image scanning, runtime protection, image signing, and security policies using tools like Falco, Trivy, and Notary.

Diagnoses and operates Kubernetes clusters: pods, deployments, ingress, HPA, PVC, StorageClass, NetworkPolicy, Secrets, Helm, ArgoCD, cert-manager. Reads before changing; mutations require confirmation and diff review.

Perform CRUD operations, queries, bulk operations, and container management on Azure Cosmos DB NoSQL API using the @azure/cosmos TypeScript/JavaScript SDK.

Migrates .NET Framework code using Thread.Abort to cooperative cancellation with CancellationToken in modern .NET 6+.

Orchestrates the full-site migration preparation cascade — inventory crawl, page-type and module catalog confirmation, archetype prototyping, and asset preparation — with confirmation gates between phases.

Provides Docker guidance covering images, Compose, networking, volumes, debugging, and production hardening, with commands and best practices for stable environments.

Docker containerization expert with deep knowledge of multi-stage builds, image optimization, container security, Docker Compose orchestration, and production deployment patterns. Use PROACTIVELY for Dockerfile optimization, container issues, image size problems, security hardening, networking, and orchestration challenges.

Kubernetes

飞书云空间（云盘/云存储）：管理 Drive 文件和文件夹，包含上传/下载、创建文件夹、复制/移动/删除、查看元数据、查询权限设置、评论/权限/订阅、标题、版本、飞书文档密级标签（secure labels）和本地文件导入。用户需要整理云盘目录、处理云空间资源 URL/token、判断链接类型/真实 token/标题，或导入 Word/Markdown/Excel/CSV/PPTX/.base 为 docx/sheet/bitable/slides 时使用；doubao.com 云空间 URL/token 也按资源路径和 token 路由，不回退 WebFetch。不负责：文档内容编辑（走 lark-doc）、表格/Base 表内数据操作（走 lark-sheets/lark-base）、知识空间节点/成员管理（走 lark-wiki）、原生 Markdown 文件读写/patch/diff（走 lark-markdown）。

Configure container-native CI/CD pipelines with Drone, including YAML pipeline definitions, plugins, secrets, and multi-machine builds.

Start a stopped Docker container by name or ID

Traces software supply chain provenance from source to runtime, identifying divergence points in dependency resolution, build, packaging, and release pipelines.

Manage files and folders in Box cloud storage. Upload, download, and list content using the Box API.

PM-invocable protocol for Cargo publish and release operations in the trusty-tools Rust monorepo: semver rules, 10-step release sequence, macOS codesign safety, and cross-crate dependency ordering

飞书云空间：管理云空间中的文件和文件夹。上传和下载文件、创建文件夹、复制/移动/删除文件、查看文件元数据、管理文档评论、管理文档权限、订阅用户评论变更事件。当用户需要上传或下载文件、整理云空间目录、查看文件详情、管理评论、管理文档权限、订阅用户评论变更事件时使用。

Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.