Container Security
hardw00t/ai-security-arsenal
Container and Kubernetes security assessment — image vulnerability scanning, SBOM diff analysis, K8s cluster auditing, RBAC privilege mapping, NetworkPolicy review, container escape testing, and…
Harden Docker/container images and runtime deployments with secure base images, non-root users, CVE scanning, SBOM/signing, seccomp/AppArmor, and Kubernetes pod security controls.
Install Container Security Hardening
$ npx skills add sickn33/agentic-awesome-skills --skill container-security-hardening -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install sickn33/agentic-awesome-skills container-security-hardening --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/container-security-hardening .claude/skills/container-security-hardening && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "container-security-hardening" agent skill from https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/container-security-hardening into .claude/skills/container-security-hardening/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "container-security-hardening", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/container-security-hardeningType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add sickn33/agentic-awesome-skills --skill container-security-hardening -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install sickn33/agentic-awesome-skills container-security-hardening --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/container-security-hardening .agents/skills/container-security-hardening && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "container-security-hardening" agent skill from https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/container-security-hardening into .agents/skills/container-security-hardening/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "container-security-hardening", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add sickn33/agentic-awesome-skills --skill container-security-hardening -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install sickn33/agentic-awesome-skills container-security-hardening --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/container-security-hardening .cursor/skills/container-security-hardening && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "container-security-hardening" agent skill from https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/container-security-hardening into .cursor/skills/container-security-hardening/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "container-security-hardening", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/sickn33/agentic-awesome-skills.git --path skills/container-security-hardening--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add sickn33/agentic-awesome-skills --skill container-security-hardening -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install sickn33/agentic-awesome-skills container-security-hardening --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/container-security-hardening .gemini/skills/container-security-hardening && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "container-security-hardening" agent skill from https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/container-security-hardening into .gemini/skills/container-security-hardening/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "container-security-hardening", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install sickn33/agentic-awesome-skills container-security-hardeningInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add sickn33/agentic-awesome-skills --skill container-security-hardening -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/container-security-hardening .github/skills/container-security-hardening && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "container-security-hardening" agent skill from https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/container-security-hardening into .github/skills/container-security-hardening/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "container-security-hardening", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add sickn33/agentic-awesome-skills --skill container-security-hardening -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install sickn33/agentic-awesome-skills container-security-hardening --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/container-security-hardening .opencode/skills/container-security-hardening && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "container-security-hardening" agent skill from https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/container-security-hardening into .opencode/skills/container-security-hardening/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "container-security-hardening", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
container-security-hardening- GitHub stars
- 47k
- Used in
- 1 other repo
- Token cost
- ~1k tokens
- SKILL.md length
- 431 words
- Files
- 5 (incl. references)
- Skills in repo
- 1,493
- Repo updated
- First seen
- Licence
- MIT
At a glance
Harden Docker/container images and runtime deployments with secure base images, non-root users, CVE scanning, SBOM/signing, seccomp/AppArmor, and Kubernetes pod security controls.
- Dockerfile security reviews
- SKILL.md covers Detailed Guide, When to Use This Skill, When NOT to Use This Skill and Security Checklist, plus 1 more section
- Calls trivy
- Distroless images
What it does
Container Security Hardening is an agent skill from sickn33/agentic-awesome-skills. Harden Docker/container images and runtime deployments with secure base images, non-root users, CVE scanning, SBOM/signing, seccomp/AppArmor, and Kubernetes pod security controls. Use for Dockerfile security reviews, container CVEs, image scanning, distroless images, or production hardening.
Its SKILL.md is about 1k tokens, which your agent loads only when the skill is triggered. The skill folder holds 5 other files, including reference files (for example `references/base-image-comparison.md`, `references/detailed-guide.md` and `references/kubernetes-pod-security.md`).
It sits in Security, covering Containers, Vulnerability scanning and Cloud security. It works with Docker and Kubernetes. The repository describes itself as: AAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 2,400+ agentic skills. Includes… The licence is MIT.
When your agent uses it
- Dockerfile security reviews
- Distroless images
- Production hardening
Example prompts
- “/container-security-hardening”
Requirements
- Docker
What it can do on your machine
Read from SKILL.md and the folder at commit 680176d. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
trivy
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Container Security Hardening loads about 1k tokens when it runs, and up to ~16k if it reads all its reference files. Until then it costs about 80 tokens; SKILL.md has 431 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check: notes
The automated check noted patterns worth knowing about, such as sudo or a known installer.
- NoteMentions a .env fileSKILL.md:54
- [ ] `.dockerignore` excludes `.git`, `.env`, secrets, tests
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from sickn33/agentic-awesome-skills at commit 680176d, republished under its MIT licence (© sickn33). 431 words, ~1,016 tokens.
Download SKILL.mdSave it as
.claude/skills/container-security-hardening/SKILL.md (or your agent's skills folder). This skill also uses 4 other files; get the full folder from GitHub.- name
- container-security-hardening
- description
- Harden Docker/container images and runtime deployments with secure base images, non-root users, CVE scanning, SBOM/signing, seccomp/AppArmor, and Kubernetes pod security controls. Use for Dockerfile security reviews, container CVEs, image scanning, distroless images, or production hardening.
- category
- security
- risk
- safe
- source
- community
- date_added
- 2026-05-30
Container Security Hardening Skill
A production-focused guide for building, scanning, and running containers securely — from Dockerfile authoring through runtime enforcement and supply chain integrity.
Detailed Guide
Read the detailed guide before executing this skill. It retains the complete procedure and reference material. Treat its safety, prerequisites, and validation requirements as mandatory. For focused work, load the relevant sections; for end-to-end work, read the guide completely.
When to Use This Skill
- User mentions Docker security, container hardening, or Dockerfile security review
- User asks about distroless images, non-root containers, or read-only filesystems
- User wants to scan images for CVEs with Trivy, Grype, or Snyk
- User mentions seccomp, AppArmor, Linux capabilities, or runtime security
- User asks "is my Dockerfile secure?" or "how do I reduce my image attack surface?"
- User wants to sign/verify images with Cosign or generate SBOMs
- User asks about Kubernetes pod security, NetworkPolicy, or RBAC hardening
- User says "fix container CVEs" or "harden my container for production"
When NOT to Use This Skill
- The user is primarily asking about GitHub Actions CI/CD → recommend
github-actions-advanced - The user needs general Docker usage help (not security) → recommend
docker-expert - The user is working with Kubernetes orchestration beyond security → recommend
kubernetes-architect - The user needs application-level security (SQL injection, XSS) → recommend
api-security-best-practices
Security Checklist
Dockerfile
- Minimal base image (distroless, slim, or alpine — not full debian/ubuntu)
- Multi-stage build — no build tools, devDependencies, or compilers in runtime image
- Non-root
USERdeclared beforeCMD/ENTRYPOINT - Base image pinned to
@sha256:...digest (not just tag) - No secrets in
ENV,ARG, orRUNcommands -
HEALTHCHECKdefined - OCI labels present (
org.opencontainers.image.*) -
.dockerignoreexcludes.git,.env, secrets, tests -
ENTRYPOINTuses exec form, not shell form
Show full SKILL.md (160 more words)Show less
Image Scanning
- Trivy or Grype scan in CI (fails on HIGH/CRITICAL)
- Hadolint passes with no warnings
- Secret scan run on image (
trivy --scanners secret) - SBOM generated and stored
-
.trivyignorehas justified entries for accepted CVEs
Runtime
-
--read-onlyfilesystem -
--cap-drop ALL(add back only what's documented as required) -
--security-opt no-new-privileges:true -
--security-opt seccomp=<profile>applied - Resource limits set (
--memory,--cpus,--pids-limit) - Image signed with Cosign; verified before deploy
Kubernetes
-
readOnlyRootFilesystem: true -
allowPrivilegeEscalation: false -
runAsNonRoot: truewith explicit UID -
capabilities.drop: ["ALL"] - Resource
requestsandlimitsdefined -
automountServiceAccountToken: false - Namespace PSA enforced at
restrictedlevel -
NetworkPolicydefault-deny applied - RBAC uses specific resource names and minimal verbs
Limitations
- Use this skill only when the task clearly matches the scope described above.
- Do not treat the output as a substitute for environment-specific penetration testing or a formal security audit.
- Seccomp profiles and AppArmor are Linux-only; macOS/Windows Docker Desktop uses different mechanisms.
- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.
© sickn33, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 4 other files (references) in skills/container-security-hardening of sickn33/agentic-awesome-skills.
- SKILL.md
- references/base-image-comparison.md
- references/detailed-guide.md
- references/kubernetes-pod-security.md
- references/seccomp-profile-template.json
Open the folder on GitHubat commit 680176d
Used in 1 other repository
We found 5 copies of this SKILL.md (exact, near-identical or edited) in other folders, from 1 other GitHub owner. This page covers the copy in sickn33/agentic-awesome-skills, which our catalogue first saw on October 7, 2026.
Compare with similar skills
Container Security Hardening next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Container Security Hardening this skillsickn33/agentic-awesome-skills | 47k | 1 repos | ~1k | Automated safety check: Notes | MIT | |
| Container Securityhardw00t/ai-security-arsenal | 104 | — | ~2.8k | Automated safety check: Pass | None | |
| Performing Container Security Scanning With Trivymukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~818 | Automated safety check: Pass | Apache-2.0 | |
| Security Analyzeraiskillstore/marketplace | 430 | — | ~1.2k | Automated safety check: Notes | None | |
| Cyberowlaikarimhabush/cyberowl | 263 | — | ~2.5k | Automated safety check: Pass | MIT | |
| Sca TrivyAgentSecOps/SecOpsAgentKit | 220 | 2 repos | ~3.7k | Automated safety check: Pass | Custom licence |
Similar skills
Performing Container Security Scanning With Trivy
mukul975/Anthropic-Cybersecurity-Skills
Runs Trivy across every target type it supports - container images, filesystems, Git repositories, and Kubernetes clusters - for OS and dependency vulnerabilities, IaC misconfiguration, exposed…
Security Analyzer
aiskillstore/marketplace
Comprehensive security vulnerability analysis for codebases and infrastructure.
Cyberowlai
karimhabush/cyberowl
Check if recent cybersecurity alerts from 10 international CERTs affect your current project.
Sca Trivy
AgentSecOps/SecOpsAgentKit
Software Composition Analysis (SCA) and container vulnerability scanning using Aqua Trivy for identifying CVE vulnerabilities in dependencies, container images, IaC misconfigurations, and license…
Alibabacloud Ecs Sec Userspace
aliyun/alibabacloud-ecs-troubleshoot-skills
Linux 用户态安全入侵检测与取证工具，专为 AI Agent 设计。自动判断服务器是否被入侵， 提供完整证据链和可执行修复建议。51 个安全分析器覆盖进程/网络/认证/持久化/Rootkit/ 恶意软件/内存取证/容器逃逸等 12 类检测维度，10 个数据采集器全面采集系统状态， 映射 103+ MITRE ATT&CK 技术，支持 standalone/docker/k8s 三种部署模式。
More from sickn33/agentic-awesome-skills
All 1,493 skills in this repoLiuguang Banlan UI
sickn33/agentic-awesome-skills
Implements an interface in one of two named color modes, iridescent white or colorful black, from a parameterized starter that reports measured color intensity.
User Thoughts Memory
sickn33/agentic-awesome-skills
Saves a user's project decisions, rules and preferences into a project-local mdbase so later sessions and other agents can recover the intent.
Using LWC Memory and Graphs
sickn33/agentic-awesome-skills
Keeps project decisions, research and verified results available across coding-agent sessions through LWC memory, a document Wiki graph and a CodeGraph code index.
Find Complementary Founders
sickn33/agentic-awesome-skills
Guides an agent through assessing its own owner for cofounder fit, publishing an approved profile, and ranking complementary profiles other agents published for their owners.
Whatsapp Cloud API
sickn33/agentic-awesome-skills
Integracao com WhatsApp Business Cloud API (Meta). An agent skill from sickn33/agentic-awesome-skills.
Cline Pilot
sickn33/agentic-awesome-skills
Acts as a proxy for the Cline CLI, dispatching coding tasks one at a time, monitoring runs by hard evidence, relaying decisions to you and learning per-project preferences.
Related
Works with
Categories
Questions about Container Security Hardening
What does Container Security Hardening do?
Harden Docker/container images and runtime deployments with secure base images, non-root users, CVE scanning, SBOM/signing, seccomp/AppArmor, and Kubernetes pod security controls. Container Security Hardening is an agent skill from sickn33/agentic-awesome-skills. Harden Docker/container images and runtime deployments with secure base images, non-root users, CVE scanning, SBOM/signing, seccomp/AppArmor, and Kubernetes pod security controls.
When should I use Container Security Hardening?
Container Security Hardening fits situations like: dockerfile security reviews; distroless images; production hardening.
How do I install Container Security Hardening in Claude Code?
Run `npx skills add sickn33/agentic-awesome-skills --skill container-security-hardening -a claude-code`. Or copy the skill folder (skills/container-security-hardening in sickn33/agentic-awesome-skills) into .claude/skills/container-security-hardening in your project. Claude Code loads it when a task matches its description.
How do I install Container Security Hardening in Codex?
Run `npx skills add sickn33/agentic-awesome-skills --skill container-security-hardening -a codex`. Or copy the skill folder (skills/container-security-hardening in sickn33/agentic-awesome-skills) into .agents/skills/container-security-hardening in your project. Codex loads it when a task matches its description.
Can I use Container Security Hardening in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add sickn33/agentic-awesome-skills --skill container-security-hardening -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/container-security-hardening, .gemini/skills/container-security-hardening, .github/skills/container-security-hardening and .opencode/skills/container-security-hardening in your project.
What does Container Security Hardening need to run?
Going by SKILL.md and its folder, Container Security Hardening needs the command-line tools its instructions call (trivy). Our summary lists: Docker.
Does Container Security Hardening access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Container Security Hardening safe to install?
Our automated static check of SKILL.md found notes only (mentions a .env file), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.
What licence does Container Security Hardening use?
Container Security Hardening is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Container Security Hardening use?
About 1k tokens (SKILL.md is roughly 4.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 15k tokens, read only when the agent opens those files.
What are the alternatives to Container Security Hardening?
Skills that share tags, products or a category with Container Security Hardening: Container Security (hardw00t/ai-security-arsenal, 104 stars), Performing Container Security Scanning With Trivy (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Security Analyzer (aiskillstore/marketplace, 430 stars) and Cyberowlai (karimhabush/cyberowl, 263 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Container Security Hardening?
sickn33 (a GitHub user) maintains it in sickn33/agentic-awesome-skills, which has 47,379 GitHub stars. The repository holds 1,493 skills in this directory. The repository was last updated on October 9, 2026.
Source: sickn33/agentic-awesome-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.