Docker Hardening

Docker Hardening

Use this skill when reviewing or improving Dockerfiles, Compose files, container runtime flags, or image build workflows.

Inputs

• Dockerfile, compose file, build logs, image metadata, deployment environment, and application runtime requirements

Steps

1. Review base image choice, version pinning, architecture, and maintenance status.
2. Check build reproducibility: pinned dependencies, deterministic package install, cache hygiene, and lockfile use.
3. Reduce image size where it also improves reliability or security: multi-stage builds, minimal runtime dependencies, and cleaned package caches.
4. Review runtime security: non-root user, file permissions, capabilities, read-only filesystem, secrets handling, exposed ports, and health checks.
5. Check supply-chain risk: curl-pipe-shell, unsigned downloads, mutable tags, and unverified artifacts.
6. Validate operational readiness: signals, graceful shutdown, logging, startup command, environment variables, and resource expectations.

Output

Return:

• Container risk summary
• Recommended Dockerfile/config changes
• Security hardening checklist
• Reproducibility and size notes
• Validation commands such as build, run, scan, or smoke test

Guidelines

• Do not optimize image size at the expense of clarity or correctness.
• Prefer pinned, maintained base images.
• Keep production runtime separate from build tooling when practical.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: jakesterns
• Source: jakesterns/agent-skills
• License: MIT

Install and usage instructions live in the source repository linked above.