container-security

仓库创建 2026年7月1日最近提交 23 天前SkillHot 收录 22 天前

▸ 精选理由

减少镜像与部署的常见误配置和漏洞风险。

这个 Skill 做什么

为 Dockerfile、OCI 镜像与 Kubernetes 配置提供加固规则与审查准则。

给 Dockerfile、OCI 镜像、Kubernetes 清单和 Helm Chart 提供加固建议和审查准则，包含多阶段构建、最小基础镜像、不要把密钥写到镜像里等实践。生成镜像或写 K8s 配置、审查 PR 时用，能拦截常见容器安全问题。特点是覆盖从构建到部署的规则集，方便在 CI/PR 流程里落地。

▸ 展开 SKILL.md 英文原文

Hardening rules for Dockerfile, OCI images, Kubernetes manifests, and Helm charts — Applies to: when generating a Dockerfile or OCI image build; when generating Kubernetes / Helm / Kustomize manifests; when reviewing container changes in PR

开发编程容器安全DockerKubernetes通用

Stars

Forks

仓库内 Skill

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/ShieldNet-360/secure-vibe/main/dist/agent-skills/.agents/skills/container-security/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/ShieldNet-360/secure-vibe/main/dist/agent-skills/.agents/skills/container-security/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

<!-- Native skill bundle for agent-skills (cross-tool convention). Generated by `secure-vibe dev regenerate`. -->
<!-- Do not edit by hand; the source of truth is skills/container-security/SKILL.md. -->

# Container Security

Hardening rules for Dockerfile, OCI images, Kubernetes manifests, and Helm charts

## ALWAYS

- Use **multi-stage builds**: separate builder/test stages from the final runtime image so build toolchains and source aren't shipped. The last stage should be `FROM distroless`, `FROM scratch`, `FROM alpine:<digest>`, or another minimal base — pinned by SHA256 digest, not just tag.
- Run as a non-root user: `USER <uid>` (numeric UID >= 10000 for K8s `runAsNonRoot` policies to

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有