skills.rest
vladkesler
vladkeslerCOMMUNITY
Explore all skills by this author →
GitHub

container-scan

Detect security and best-practice gaps in Dockerfiles via rule-based code review.

39|6|Updated Feb 9, 2026
Search Tags:#security#docker#secrets#dockerfile#code-review#base-image
One-click install
npx skills add https://github.com/vladkesler/initrunner --skill container-scan
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: container-scan
Source: https://github.com/vladkesler/initrunner/tree/main/examples/roles/security-scanner/skills/container-scan
Command: npx skills add https://github.com/vladkesler/initrunner --skill container-scan

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Dockerfiles often contain misconfigurations and insecure patterns that can lead to insecure containers. container-scan provides automated checks to flag root execution, unpinned base images, embedded secrets, and other best-practice violations, enabling faster remediation.

Core Features & Use Cases

  • Detect running as root and failing to switch to a non-root user.
  • Identify unpinned or latest-base images and suggest pinning to a specific version or digest.
  • Flag secrets in ENV/ARG, COPY of credential files, and other sensitive patterns.
  • Suggest improvements like proper HEALTHCHECKs and multi-stage builds.
  • Use Case: During a PR, run the scan to surface critical issues before merging to reduce attack surface.

Quick Start

Run the container-scan on your repository's Dockerfiles to generate a security assessment.

Frequently Asked Questions about container-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan a Dockerfile for security issues like root execution and embedded secrets?▼

Scanning a Dockerfile for security issues involves performing rule-based code review to detect root execution, unpinned base images, and embedded secrets. This Skill analyzes Dockerfiles and docker-compose configurations to output actionable findings for faster remediation.

What common Dockerfile misconfigurations lead to insecure containers?▼

Common Dockerfile misconfigurations include running as root, using unpinned or latest base images, embedding secrets in ENV/ARG directives, and copying credential files. This Skill flags these best-practice violations along with missing HEALTHCHECKs and multi-stage builds.

Do I need external security tools to check Dockerfiles during a pull request?▼

No external security tools are required to check Dockerfiles during a pull request. This Skill relies entirely on Python parsing to perform rule-based security reviews, requiring zero external dependencies to identify insecure patterns.

Can I detect hardcoded secrets in docker-compose configurations automatically?▼

You can detect hardcoded secrets in docker-compose configurations automatically using this Skill. It flags sensitive patterns like secrets in ENV/ARG directives and COPY commands for credential files across repositories containing Dockerfiles or docker-compose configurations.

Why should I pin base images in my Dockerfile?▼

You should pin base images in your Dockerfile to prevent unexpected changes and vulnerabilities from latest tags. This Skill identifies unpinned or latest-base images and suggests pinning to a specific version or digest to reduce the container attack surface.

Related Skills

Explore More Software Engineering Skills→
SnakeOSnakeO
9

refactor:docker

Refactor Dockerfiles and docker-compose setups for security, performance, and maintainability.

Community
Advanced
jtucker9jtucker9

secrets-scanner

Detect hardcoded secrets in codebases and Git history.

Community
Advanced
luongnv89luongnv89
104

devops-pipeline

Automate pre-commit hooks and GitHub Actions for code quality.

Community
Advanced
kalshamsikalshamsi
1

docker-scout-scanner

Scan Docker images and Dockerfiles for CVEs and misconfigurations.

Community
Advanced