Security Container Security

Purpose

Build a container security program spanning image scanning (Trivy, Grype, Clair, Snyk), Dockerfile hardening (distroless, multi-stage, non-root), admission control (Kyverno, OPA/Gatekeeper), runtime monitoring (Falco, Tracee), image signing (Cosign), and SBOM generation.

Agent Protocol

Trigger

Exact user phrases: "container security", "image scanning", "Trivy", "Grype", "Clair", "Snyk", "Dockerfile security", "admission control", "Kyverno", "OPA", "runtime security", "Falco", "Tracee", "container CVE", "distroless", "multi-stage build", "image hardening", "K8s security", "container vulnerability", "Cosign", "image signing", "SBOM", "container admission", "pod security".

Input Context

Before activating, verify:

• Container registry (Docker Hub, ECR, GCR, GAR, ACR)
• Orchestration platform (Kubernetes, ECS, Nomad)
• CI/CD platform and image build pipeline
• Existing security tools and incident history
• Compliance standards (PCI DSS, SOC 2, HIPAA)
• Image volume (number of images, build frequency)