container-hardening
Installation
SKILL.md
Container Hardening
Secure container images and runtime configuration to reduce attack surface, prevent privilege escalation, and ensure compliance with Kubernetes security best practices.
Base Image Selection
- Use a Universal Base Image (UBI) from the official Red Hat Container Registry
- Prefer ubi-minimal (
ubi8/ubi-minimalorubi9/ubi-minimal) to reduce attack surface - Use the most up-to-date image available
Required for: all profiles (mandatory)
Image Tagging Strategy
| Source | Strategy |
|---|---|
| Red Hat Catalog | Omit floating tags to get the latest image; exception: Konflux project uses digest-based pinning with automated updates |
| Non-Red Hat registries | Pin the version or digest to ensure you use the intended image and not a tampered one |