skills.rest
nebius
nebiusOFFICIAL
Explore all skills by this author →
WebsiteGitHub

container

Create, audit, and validate Dockerfiles, Compose files, and OCI container images.

7|5|Updated Jul 22, 2025
Search Tags:#docker#containers#dockerfile#compose#hardening#oci#image audit
One-click install
npx skills add https://github.com/nebius/nebius-ps-services --skill container-nebius
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: container
Source: https://github.com/nebius/nebius-ps-services/tree/main/skills/container
Command: npx skills add https://github.com/nebius/nebius-ps-services --skill container-nebius

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve? Building secure, reproducible, production-grade container images requires coordinating Dockerfile design, runtime contracts, hardening, and validation evidence, which is error-prone when done ad hoc. ## Core Features & Use Cases - Dockerfile and Compose Engineering: Create, review, and harden Dockerfiles, Containerfiles, build contexts, .dockerignore rules, and Compose files against explicit build and runtime standards. - Offline-First Auditing: Run scripts/container_audit.py for static source checks, local image inspection, and optional opt-in build, runtime smoke test, and supply-chain evidence collection. - Bounded Runtime Validation: Use scripts/container_smoke_test.py for disposable, resource-limited local container tests with dropped capabilities, no-new-privileges, and verified cleanup. - Use Case: Given a Python service repository, classify the workload, render the typed Dockerfile profile, audit it offline, then run an authorized build and smoke test to produce a documented runtime contract. ## Quick Start Use the container skill to review the Dockerfile and compose.yaml in this repository and report hardening findings with a runtime contract.

Frequently Asked Questions about container

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a Dockerfile for security issues?▼

Run scripts/container_audit.py against the repository for an offline static audit. It checks base image pinning, secret-like ARG/ENV names, non-root USER, exec-form commands, .dockerignore coverage, and OCI labels without contacting a network.

How to test a Docker image locally without deploying it?▼

Use scripts/container_smoke_test.py with an explicit image reference. It creates a bounded disposable container with dropped capabilities, no-new-privileges, memory and CPU limits, optional loopback health checks, and verified task-owned cleanup.

Does the container audit require network access or Docker?▼

Static source checks run fully offline. Docker-dependent modes such as image inspection, compose config validation, --build, --runtime-test, and --supply-chain are separate explicit opt-ins, and --build additionally requires --allow-network.

Can this skill push or sign container images?▼

No. Registry pushes, signing, pruning, deployment, and daemon changes are explicitly out of scope and delegated to sibling skills such as publish-image. The skill stops at a validated local image and documented runtime contract.

What Compose configurations are flagged during an audit?▼

The audit flags privileged services, host network/PID/IPC namespaces, Docker socket mounts, :latest image references, literal secret environment values, and source bind mounts, while noting that static checks are not a full rendered-model security audit.

Related Skills

Explore More Software Engineering Skills→
mckissingermckissinger
1

spec-foundation

Create product, architecture, environment, and process specification artifacts for new software projects.

Community
Advanced
lukaskellersteinlukaskellerstein
3

helm

Author, template, and manage Helm chart releases on Kubernetes clusters.

Community
Intermediate
valITinovalITino
7

vuln-assessment

Identify and validate security weaknesses in authorized targets with PoC evidence.

Community
Advanced
cuiosscuioss
4

oci-standards

Standardizes OCI container image building, labeling, health probing, and Dockerfile hygiene for CI/CD workflows.

Official
Intermediate