New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Container Hardening

by BagelHole in BagelHole/DevOps-Security-Agent-Skills

Secure Docker images and container runtime configurations. An agent skill from BagelHole/DevOps-Security-Agent-Skills.

MITAuto-check passedDevOps & Cloud

Install Container Hardening

skills CLI
$ npx skills add BagelHole/DevOps-Security-Agent-Skills --skill container-hardening -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install BagelHole/DevOps-Security-Agent-Skills container-hardening --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/BagelHole/DevOps-Security-Agent-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/security/hardening/container-hardening .claude/skills/container-hardening && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
container-hardening
GitHub stars
1.2k
Token cost
~529 tokens
SKILL.md length
75 words
Files
2 (incl. references)
Skills in repo
44
Repo updated
First seen
Licence
MIT

At a glance

Secure Docker images and container runtime configurations. An agent skill from BagelHole/DevOps-Security-Agent-Skills.

  • Building secure container images
  • SKILL.md covers When to Use This Skill, Dockerfile Security, Runtime Security and Kubernetes Security Context, plus 3 more sections
  • Calls docker and trivy
  • Hardening container deployments

What it does

Container Hardening is an agent skill from BagelHole/DevOps-Security-Agent-Skills. Secure Docker images and container runtime configurations. Implement non-root users, read-only filesystems, and security contexts. Use when building secure container images or hardening container deployments.

Its SKILL.md is about 530 tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including reference files (for example `references/container-security.md`).

It sits in DevOps & Cloud, covering Containers and Deployment. It works with Docker and Kubernetes. The repository describes itself as: Agent-ready DevOps, security, infrastructure, and compliance knowledge base with 80+ skills across Kubernetes, Terraform, AWS/Azure/GCP, AI platform operations, container… The licence is MIT.

When your agent uses it

  • Building secure container images
  • Hardening container deployments

Example prompts

  • “/container-hardening”

Requirements

  • Docker

What it can do on your machine

Read from SKILL.md and the folder at commit 0365f57. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • docker
    • trivy

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use docker, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Container Hardening loads about 529 tokens when it runs, and up to ~977 if it reads all its reference files. Until then it costs about 57 tokens; SKILL.md has 75 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~57
When it runs · the whole SKILL.md, loaded when a task matches
~529
With references · SKILL.md plus every file in references/, read only if the agent opens them
~977

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from BagelHole/DevOps-Security-Agent-Skills at commit 0365f57, republished under its MIT licence (© BagelHole). 75 words, ~529 tokens.

Download SKILL.mdSave it as .claude/skills/container-hardening/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.
name
container-hardening
description
Secure Docker images and container runtime configurations. Implement non-root users, read-only filesystems, and security contexts. Use when building secure container images or hardening container deployments.
license
MIT
metadata.author
devops-skills
metadata.version
1.0

Container Hardening

Secure container images and runtime configurations.

When to Use This Skill

Use this skill when:

  • Building secure container images
  • Hardening container deployments
  • Meeting container security requirements
  • Implementing defense in depth

Dockerfile Security

dockerfile
# Use minimal base image
FROM alpine:3.18

# Don't run as root
RUN addgroup -g 1001 -S appgroup && \
    adduser -u 1001 -S appuser -G appgroup

# Copy with specific ownership
COPY --chown=appuser:appgroup . /app

# Remove unnecessary packages
RUN apk del --purge build-dependencies && \
    rm -rf /var/cache/apk/*

# Use non-root user
USER appuser

# Read-only filesystem support
WORKDIR /app

Runtime Security

bash
# Run with security options
docker run -d \
  --read-only \
  --tmpfs /tmp \
  --security-opt=no-new-privileges:true \
  --cap-drop=ALL \
  --cap-add=NET_BIND_SERVICE \
  --user 1001:1001 \
  myapp:latest

Kubernetes Security Context

yaml
apiVersion: v1
kind: Pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1001
    fsGroup: 1001
  containers:
  - name: app
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop: ["ALL"]

Image Scanning

bash
# Scan with Trivy
trivy image --severity HIGH,CRITICAL myapp:latest

# Use distroless images
FROM gcr.io/distroless/static-debian11

Best Practices

  • Use minimal base images
  • Run as non-root user
  • Enable read-only filesystem
  • Drop all capabilities
  • Scan images regularly
  • Sign and verify images
  • Use secrets management

© BagelHole, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file (references) in security/hardening/container-hardening of BagelHole/DevOps-Security-Agent-Skills.

  • SKILL.md
  • references/container-security.md

Open the folder on GitHubat commit 0365f57

Compare with similar skills

Container Hardening next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Container Hardening compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Container Hardening this skillBagelHole/DevOps-Security-Agent-Skills1.2k—~529Automated safety check: PassMIT
Senior DevOps Toolkitmaslennikov-ig/claude-code-orchestrator-kit2606 repos~1.1kAutomated safety check: NotesCustom licence
LangBot Deployment Guidelangbot-app/LangBot18k—~1.5kAutomated safety check: NotesApache-2.0
Debug Openshell ClusterNVIDIA/OpenShell16k—~20kAutomated safety check: NotesApache-2.0
Deploymentmatrixorigin/memoria610—~1.6kAutomated safety check: NotesApache-2.0
Onboarding Validationopen-edge-platform/edge-ai-suites140—~3.3kAutomated safety check: PassApache-2.0

Similar skills

  • Senior DevOps Toolkit

    maslennikov-ig/claude-code-orchestrator-kit

    Comprehensive DevOps skill for CI/CD, infrastructure automation, containerization, and cloud platforms (AWS, GCP, Azure). Includes pipeline setup…

    260 GitHub starsUsed in 6 repos~1.1k tokens
    DevOps & CloudAuto-check: notes

  • LangBot Deployment Guide

    langbot-app/LangBot

    Deploys and configures a LangBot instance with Docker Compose or Kubernetes, covering config.yaml, the Box sandbox runtime, the plugin runtime and the global API key.

    18k GitHub stars~1.5k tokensUpdated today
    DevOps & CloudAuto-check: notes

  • Debug Openshell Cluster

    NVIDIA/OpenShell

    Official

    Debug why an OpenShell gateway deployment is unhealthy, unreachable, or unable to create sandboxes.

    16k GitHub stars~20k tokensUpdated yesterday
    DevOps & CloudAuto-check: notes

  • Deployment

    matrixorigin/memoria

    Deploy Memoria with Docker Compose or Kubernetes. An agent skill from matrixorigin/memoria.

    610 GitHub stars~1.6k tokensUpdated yesterday
    DevOps & CloudAuto-check: notes

  • Onboarding Validation

    open-edge-platform/edge-ai-suites

    Validate the get-started experience of Open Edge Platform (OEP) software components from the perspective of a first-time user.

    140 GitHub stars~3.3k tokensUpdated yesterday
    DevOps & CloudAuto-check passed

  • Agenticx Deployer

    DemonDamon/AgenticX

    Guide for deploying AgenticX agents to production including Docker containerization, Kubernetes orchestration, Volcengine AgentKit cloud deployment, and API server setup.

    364 GitHub stars~866 tokensUpdated today
    DevOps & CloudAuto-check passed

More from BagelHole/DevOps-Security-Agent-Skills

All 44 skills in this repo

  • Hashicorp Vault

    BagelHole/DevOps-Security-Agent-Skills

    Manage secrets and PKI with HashiCorp Vault. An agent skill from BagelHole/DevOps-Security-Agent-Skills.

    1.2k GitHub stars~2k tokensUpdated 4 mo ago
    Auto-check passed

  • Incident Response

    BagelHole/DevOps-Security-Agent-Skills

    Handle security incidents with IR playbooks and procedures. An agent skill from BagelHole/DevOps-Security-Agent-Skills.

    1.2k GitHub stars~4.5k tokensUpdated 4 mo ago
    Auto-check passed

  • Kubernetes Ops

    BagelHole/DevOps-Security-Agent-Skills

    Deploy, scale, and manage Kubernetes workloads. An agent skill from BagelHole/DevOps-Security-Agent-Skills.

    1.2k GitHub stars~2.3k tokensUpdated 4 mo ago
    Auto-check passed

  • Linux Hardening

    BagelHole/DevOps-Security-Agent-Skills

    Apply CIS benchmarks and secure Linux servers. An agent skill from BagelHole/DevOps-Security-Agent-Skills.

    1.2k GitHub stars~662 tokensUpdated 4 mo ago
    Auto-check: notes

  • Prometheus Grafana

    BagelHole/DevOps-Security-Agent-Skills

    Set up metrics collection and visualization with Prometheus and Grafana.

    1.2k GitHub stars~2.5k tokensUpdated 4 mo ago
    Auto-check passed

  • Vulnerability Scanning

    BagelHole/DevOps-Security-Agent-Skills

    Scan systems and dependencies for CVEs and security vulnerabilities.

    1.2k GitHub stars~2.4k tokensUpdated 4 mo ago
    Auto-check passed

Works with

Categories

Questions about Container Hardening

What does Container Hardening do?

Secure Docker images and container runtime configurations. An agent skill from BagelHole/DevOps-Security-Agent-Skills. Container Hardening is an agent skill from BagelHole/DevOps-Security-Agent-Skills. Secure Docker images and container runtime configurations.

When should I use Container Hardening?

Container Hardening fits situations like: building secure container images; hardening container deployments.

How do I install Container Hardening in Claude Code?

Run `npx skills add BagelHole/DevOps-Security-Agent-Skills --skill container-hardening -a claude-code`. Or copy the skill folder (security/hardening/container-hardening in BagelHole/DevOps-Security-Agent-Skills) into .claude/skills/container-hardening in your project. Claude Code loads it when a task matches its description.

How do I install Container Hardening in Codex?

Run `npx skills add BagelHole/DevOps-Security-Agent-Skills --skill container-hardening -a codex`. Or copy the skill folder (security/hardening/container-hardening in BagelHole/DevOps-Security-Agent-Skills) into .agents/skills/container-hardening in your project. Codex loads it when a task matches its description.

Can I use Container Hardening in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add BagelHole/DevOps-Security-Agent-Skills --skill container-hardening -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/container-hardening, .gemini/skills/container-hardening, .github/skills/container-hardening and .opencode/skills/container-hardening in your project.

What does Container Hardening need to run?

Going by SKILL.md and its folder, Container Hardening needs the command-line tools its instructions call (docker and trivy). Our summary lists: Docker.

Does Container Hardening access the network?

SKILL.md contains no URLs. Its commands use docker, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Container Hardening safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Container Hardening use?

Container Hardening is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Container Hardening use?

About 529 tokens (SKILL.md is roughly 2.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 448 tokens, read only when the agent opens those files.

What are the alternatives to Container Hardening?

Skills that share tags, products or a category with Container Hardening: Senior DevOps Toolkit (maslennikov-ig/claude-code-orchestrator-kit, 260 stars), LangBot Deployment Guide (langbot-app/LangBot, 18k stars), Debug Openshell Cluster (NVIDIA/OpenShell, 16k stars) and Deployment (matrixorigin/memoria, 610 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Container Hardening?

BagelHole (a GitHub user) maintains it in BagelHole/DevOps-Security-Agent-Skills, which has 1,152 GitHub stars. The repository holds 44 skills in this directory. The repository was last updated on May 22, 2026.

Source: BagelHole/DevOps-Security-Agent-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.