# Containerization

> Enforce container security best practices for MCP servers, including OpenShift integration. Use when containerizing MCP servers or reviewing container security configurations for MCP deployments.

- **Type:** Skill
- **Install:** `agentstack add skill-redhatproductsecurity-prodsec-skills-containerization`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [RedHatProductSecurity](https://agentstack.voostack.com/s/redhatproductsecurity)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [RedHatProductSecurity](https://github.com/RedHatProductSecurity)
- **Source:** https://github.com/RedHatProductSecurity/prodsec-skills/tree/main/module/skills/containerization

## Install

```sh
agentstack add skill-redhatproductsecurity-prodsec-skills-containerization
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Containerization and OpenShift Integration for MCP Servers

## Security Recommendation

MCP servers SHOULD run in containers, leveraging container orchestration platform security features (e.g., OpenShift SCCs) for a hardened-by-default posture.

## Container Security Requirements

### Run as Non-Root

The container MUST run as a non-root user. OpenShift's default Security Context Constraints (SCCs) enforce this automatically.

```yaml
securityContext:
  runAsNonRoot: true
  runAsUser: 1000
```

### Drop All Capabilities

Remove all Linux capabilities and add back only what is strictly needed:

```yaml
securityContext:
  capabilities:
    drop: ["ALL"]
```

### Read-Only Root Filesystem

Use a read-only root filesystem. Mount a `tmpfs` only for directories that require temporary writes:

```yaml
securityContext:
  readOnlyRootFilesystem: true
volumeMounts:
  - name: tmp
    mountPath: /tmp
volumes:
  - name: tmp
    emptyDir:
      medium: Memory
```

### Kernel Hardening

| Mechanism | Details |
|---|---|
| **SELinux** | Enabled by default in OpenShift; confines container processes |
| **seccomp** | Apply seccomp profiles to restrict available system calls |

```yaml
securityContext:
  seccompProfile:
    type: RuntimeDefault
  seLinuxOptions:
    type: container_t
```

### Network Policies

Use Kubernetes NetworkPolicies as a pod-level firewall to control all ingress and egress traffic:

```yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: mcp-server-policy
spec:
  podSelector:
    matchLabels:
      app: mcp-server
  policyTypes: ["Ingress", "Egress"]
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: mcp-client
      ports:
        - port: 8080
  egress:
    - to:
        - podSelector:
            matchLabels:
              app: auth-server
      ports:
        - port: 443
```

## Base Image Selection

- Use a **Universal Base Image (UBI)** from the official [Red Hat Container Registry](https://catalog.redhat.com/software/containers/search) as the foundation for MCP server containers
- Prefer **ubi-minimal** to reduce attack surface and installed package count
- Use the most up-to-date image available
- For Red Hat Catalog images, omit floating tags to ensure the latest image is pulled (exception: Konflux uses digest-based pinning with automated updates)
- For non-Red Hat images, **pin the version or digest** to prevent pulling a tampered image
- Remove non-essential packages and clean caches:

```dockerfile
RUN microdnf upgrade -y && microdnf install -y  && microdnf remove -y  && microdnf clean all
```

## Containerfile Linting

Use [Hadolint](https://github.com/hadolint/hadolint) to lint Containerfiles for best-practice violations. Run it in CI but verify findings manually -- do not trust it blindly.

## Implementation Checklist

- [ ] Base image is a Red Hat UBI (preferably ubi-minimal)
- [ ] Non-Red Hat base images are pinned by version or digest
- [ ] Non-essential packages are removed and caches cleaned
- [ ] Run container as non-root user (`runAsNonRoot: true`)
- [ ] Drop all Linux capabilities (`drop: ["ALL"]`)
- [ ] Use read-only root filesystem (`readOnlyRootFilesystem: true`)
- [ ] `allowPrivilegeEscalation: false` is set (no-new-privileges)
- [ ] Mount `tmpfs` only for directories needing temporary writes
- [ ] Apply seccomp profile (`RuntimeDefault` or custom)
- [ ] Ensure SELinux is enabled and container type is appropriate
- [ ] Deploy Kubernetes NetworkPolicies controlling ingress and egress
- [ ] Use OpenShift SCCs or equivalent to enforce security context defaults
- [ ] Hadolint runs in CI on all Containerfiles
- [ ] Scan container images for vulnerabilities before deployment

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [RedHatProductSecurity](https://github.com/RedHatProductSecurity)
- **Source:** [RedHatProductSecurity/prodsec-skills](https://github.com/RedHatProductSecurity/prodsec-skills)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-redhatproductsecurity-prodsec-skills-containerization
- Seller: https://agentstack.voostack.com/s/redhatproductsecurity
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.