# Container Security Hardening

> Use when hardening container images and deployments.

- Skill: `loopyluci/container-security-hardening` (Agent Skill)
- Install (CLI): `npx skillmds@latest add loopyluci/container-security-hardening`
- Raw SKILL.md: https://api.skillmd.com/api/skills/loopyluci/container-security-hardening/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: LoopyLuci (https://skillmd.com/u/loopyluci)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/loopyluci/container-security-hardening

---


# Container Security Hardening

Hardening container images and deployments — from minimal base images through vulnerability scanning, runtime security, and Kubernetes Pod Security Standards.

## When to Use

- Reducing attack surface of container images
- Scanning for vulnerabilities in container images
- Running containers with least privilege
- Implementing Kubernetes pod security
- Building secure CI/CD container pipelines

## Hardening Practices

```python
CONTAINER_HARDENING = {
    'base_images': 'Use distroless (Google) or scratch, avoid full OS images',
    'non_root': 'USER nobody in Dockerfile, never run as root',
    'read_only': 'Read-only root filesystem, tmpfs for what needs write',
    'minimal_layers': 'Single RUN apt, multi-stage builds, squashing layers',
    'scanning': 'Trivy, Grype, Clair in CI — fail builds on critical CVEs',
}

DOCKERFILE_SECURE = """
# Multi-stage: build stage
FROM golang:1.21 AS builder
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 go build -o app .

# Distroless runtime stage
FROM gcr.io/distroless/static-debian12:nonroot
COPY --from=builder /app/app /app
USER nonroot:nonroot
EXPOSE 8080
ENTRYPOINT ["/app"]
"""
```

## Verification Checklist

- [ ] Base image is minimal (distroless or scratch)
- [ ] Container runs as non-root user
- [ ] Root filesystem is read-only
- [ ] Image scanned for vulnerabilities (Trivy/Grype)
- [ ] No sensitive data in image (env vars, secrets)
- [ ] Seccomp/apparmor profiles applied
- [ ] Resource limits set (CPU, memory)
- [ ] Image signed and verified in deployment