docker-security-checker

What problem does it solve?

This Skill eliminates the risk of container supply-chain attacks and unhardened production deployments by identifying vulnerabilities, misconfigurations, and deviations from 2026 container security best practices in Dockerfiles and built container images before attackers can exploit them to compromise hosts or clusters.

Core Features & Use Cases

• Dockerfile Security Linting: Scans Dockerfiles for high-risk misconfigurations including running as root, unpinned base image tags, secret leaks in build layers, and unsafe curl|sh patterns, aligned with CIS Docker Benchmark controls.
• Image Vulnerability Scanning: Integrates with Trivy, Grype, Snyk, and Docker Scout to detect critical and high-severity CVEs in built container images, with fail-on-critical CI integration.
• 2026 Hardening Enforcement: Validates adherence to modern best practices including distroless base image usage, mandatory multi-stage builds, digest-pinned base images, Cosign image signing, SBOM generation, and runtime security observability with Falco.
• Use Case: A team preparing to deploy a Python FastAPI service can use this Skill to catch a hardcoded database password in their Dockerfile, 8 critical CVEs in their base image, and a missing .dockerignore file before the image is pushed to production.

Quick Start

Use the docker-security-checker skill to scan your project's Dockerfile and latest built container image for security vulnerabilities and 2026 hardening gaps, then receive a prioritized report of required fixes aligned with CIS and OWASP standards.