# Container Security

> Secure container images and runtime environments. Use when building Dockerfiles, scanning images, or hardening container deployments.

- **Type:** Skill
- **Install:** `agentstack add skill-ihatesea69-kiro-kit-container-security`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [ihatesea69](https://agentstack.voostack.com/s/ihatesea69)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [ihatesea69](https://github.com/ihatesea69)
- **Source:** https://github.com/ihatesea69/kiro-kit/tree/main/.kiro/skills/container-security
- **Website:** https://www.npmjs.com/package/kiro-kit

## Install

```sh
agentstack add skill-ihatesea69-kiro-kit-container-security
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Container Security

Activate this skill when securing container images and runtime environments.

## When to Use

- Building secure Dockerfiles
- Scanning images for vulnerabilities
- Configuring container runtime security
- Implementing image signing and verification
- Setting up admission controllers
- Hardening Kubernetes pod security

## Best Practices

- Use minimal base images (distroless, alpine, scratch)
- Run containers as non-root user
- Drop all capabilities, add only what is needed
- Use read-only root filesystem where possible
- Scan images in CI pipeline before pushing to registry
- Sign images with cosign or Notary
- Set resource limits to prevent DoS
- Use seccomp and AppArmor profiles

## Scanning Tools

- Trivy: comprehensive vulnerability scanner
- Grype: container image vulnerability scanner
- Hadolint: Dockerfile linter
- Dockle: container image security linter

## Rules

- Never use `latest` tag in production
- Never run as root unless absolutely required
- Never store secrets in image layers
- Always scan before deploying to production
- Pin all package versions in Dockerfiles
- Remove build tools from final image stage

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [ihatesea69](https://github.com/ihatesea69)
- **Source:** [ihatesea69/kiro-kit](https://github.com/ihatesea69/kiro-kit)
- **License:** MIT
- **Homepage:** https://www.npmjs.com/package/kiro-kit

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-ihatesea69-kiro-kit-container-security
- Seller: https://agentstack.voostack.com/s/ihatesea69
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.