skills.rest
robotijn
robotijnCOMMUNITY
Explore all skills by this author →
GitHub

docker-security-checker

Scan Dockerfiles and container images for security vulnerabilities and hardening gaps.

3|2|Updated Jan 23, 2026
Search Tags:#docker#container security#ci/cd security#vulnerability scanning#supply chain security#image hardening#dockerfile linting
One-click install
npx skills add https://github.com/robotijn/ctoc --skill docker-security-checker
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: docker-security-checker
Source: https://github.com/robotijn/ctoc/tree/main/skills/infrastructure/docker-security-checker
Command: npx skills add https://github.com/robotijn/ctoc --skill docker-security-checker

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill eliminates the risk of container supply-chain attacks and unhardened production deployments by identifying vulnerabilities, misconfigurations, and deviations from 2026 container security best practices in Dockerfiles and built container images before attackers can exploit them to compromise hosts or clusters.

Core Features & Use Cases

  • Dockerfile Security Linting: Scans Dockerfiles for high-risk misconfigurations including running as root, unpinned base image tags, secret leaks in build layers, and unsafe curl|sh patterns, aligned with CIS Docker Benchmark controls.
  • Image Vulnerability Scanning: Integrates with Trivy, Grype, Snyk, and Docker Scout to detect critical and high-severity CVEs in built container images, with fail-on-critical CI integration.
  • 2026 Hardening Enforcement: Validates adherence to modern best practices including distroless base image usage, mandatory multi-stage builds, digest-pinned base images, Cosign image signing, SBOM generation, and runtime security observability with Falco.
  • Use Case: A team preparing to deploy a Python FastAPI service can use this Skill to catch a hardcoded database password in their Dockerfile, 8 critical CVEs in their base image, and a missing .dockerignore file before the image is pushed to production.

Quick Start

Use the docker-security-checker skill to scan your project's Dockerfile and latest built container image for security vulnerabilities and 2026 hardening gaps, then receive a prioritized report of required fixes aligned with CIS and OWASP standards.

Frequently Asked Questions about docker-security-checker

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan a Dockerfile for security misconfigurations and hardcoded secrets?▼

Dockerfile security scanning checks for high-risk misconfigurations like running as root, unpinned base image tags, and secret leaks in build layers. It aligns validations with CIS Docker Benchmark controls to catch unsafe patterns before pushing images.

What is distroless base image usage and how does it enforce container hardening?▼

Distroless base image usage removes unnecessary operating system packages from container images to reduce attack surface. Enforcing this hardening practice ensures containers contain only application dependencies and runtime requirements, eliminating shell access and potential vulnerabilities.

Can I integrate vulnerability scanning for critical CVEs into my CI/CD pipeline?▼

Yes, you can integrate vulnerability scanning into CI/CD pipelines using Trivy, Grype, Snyk, or Docker Scout to detect critical and high-severity CVEs. Pipeline gates can be configured to fail builds automatically when critical vulnerabilities are found in built container images.

Does container image hardening work with Python, Node.js, and Postgres dev containers?▼

Yes, container image hardening applies to workloads across Python, Node.js, Postgres dev containers, and other runtimes like C#, Java, C, and C++. It validates security practices regardless of the application stack or development environment used.

What's the best way to generate an SBOM and sign container images for supply chain security?▼

The best way to secure supply chains is generating Software Bills of Materials (SBOM) and signing images with Cosign. These practices verify image integrity, track component provenance, and enforce mandatory 2026 container hardening best practices.

Why should I use digest-pinned base images and multi-stage builds in Docker?▼

Digest-pinned base images and multi-stage builds prevent supply chain attacks by ensuring immutable, verified dependencies and removing build tools from final images. These mandatory hardening practices eliminate unpinned tag risks and reduce production attack surface.

Related Skills

Explore More Software Engineering Skills→
pantheon-orgpantheon-org
9

dockerfile-generator

Generate Dockerfiles with multi-stage builds and .dockerignore files.

Official
Advanced
altrupetsaltrupets

Container Security

Automate container security with image scanning, runtime monitoring, and signing.

Official
Advanced
alirezarezvanialirezarezvani
24.2k

senior-secops

Automate security scanning, vulnerability assessment, and compliance checks with Python scripts.

Community
Intermediate
zzw4257zzw4257

kube-bench

Audit Kubernetes clusters against the CIS Kubernetes Benchmark.

Community
Intermediate