Container Hardening

When to use

This skill covers the container-image layer: what's inside, how it runs, and how you prove it checks out. It's the foundation k8s-security builds on (K8s takes these images and adds cluster-level controls).

Activates on:

• A request like "review our Dockerfile", "migrate to distroless", "why does our container run as root", "trivy scan triage", "sign images with cosign".
• A new or modified Dockerfile, Containerfile, docker-compose.yml, .dockerignore, multi-stage build script.
• An image-scan output (trivy/grype/snyk container) that needs triaging.
• A handoff from security-review phase 3 (container in scope) or from k8s-security (PodSecurityContext points to an image-level issue).
• A supply-chain moment: image needs to be signed, attestation published. Together with supply-chain.

When NOT to use (handoff)