skills.rest
microsoft
microsoftOFFICIAL
Explore all skills by this author →
Website𝕏@OpenAtMicrosoftGitHub

owasp-docker

Identifies, assesses, and remediates Docker container security risks using OWASP Docker Top 6 references.

1.4k|284|Updated Nov 2, 2025
Search Tags:#owasp#vulnerability assessment#remediation#docker#container security#devsecops#hardening
One-click install
npx skills add https://github.com/microsoft/hve-core --skill owasp-docker
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: owasp-docker
Source: https://github.com/microsoft/hve-core/tree/main/.github/skills/security/owasp-docker
Command: npx skills add https://github.com/microsoft/hve-core --skill owasp-docker

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Docker environments often ship with insecure defaults such as root-run containers, unpatched images, flat networks, and missing resource limits. This Skill gives an agent structured OWASP Docker Top 6 knowledge to identify, assess, and remediate those container security risks.

Core Features & Use Cases

  • Vulnerability Reference Library: Six normative documents covering secure user mapping, patch management, network segmentation, secure defaults and hardening, security contexts, and resource protection.
  • Detection and Remediation Guidance: Each reference includes checklists, prevention controls, example attack scenarios, detection commands, and remediation steps.
  • Use Case: While reviewing a Dockerfile or deployment configuration, ask the agent to check for OWASP Docker risks; it can flag a missing USER directive, the --privileged flag, or absent memory limits and recommend concrete fixes.

Quick Start

Review my Dockerfile and container deployment configuration against the OWASP Docker Top 6 and list any vulnerabilities with remediation steps.

Frequently Asked Questions about owasp-docker

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check Docker containers for security vulnerabilities?▼

Use the OWASP Docker Top 6 checklists to audit containers for root execution, missing USER directives, the --privileged flag, unpatched images, flat networks, and absent resource limits. Commands like docker inspect and docker stats help verify runtime posture.

What are the OWASP Docker Top 6 security risks?▼

They are secure user mapping (D01), patch management strategy (D02), network segmentation and firewalling (D03), secure defaults and hardening (D04), maintain security contexts (D05), and resource protection (D07). Each covers a distinct container risk category.

How do I stop Docker containers from running as root?▼

Add a dedicated user in the Dockerfile with useradd or adduser, then set the USER directive before the entrypoint. Additionally enable user namespace remapping with --userns-remap and avoid the --privileged flag.

Why is the --privileged flag dangerous in Docker?▼

The --privileged flag grants the container all Linux capabilities and access to host devices, /sys, and /proc. A breakout from a privileged container is nearly equivalent to no isolation, allowing kernel module loading and full host compromise.

Does this skill scan containers automatically?▼

No, it is a knowledge base of reference documents an agent queries during reviews. It provides detection commands and checklists, but actual scanning requires running the suggested Docker, nmap, or vulnerability scanner commands in your environment.

Related Skills

Explore More Software Engineering Skills→
Intense-VisionsIntense-Visions
18

harness-containerization

Analyze Dockerfiles and Kubernetes manifests for container best practices and misconfigurations.

Official
Advanced
salmanabdurrahmansalmanabdurrahman

tech-docker

Analyze Docker daemon configurations, Dockerfiles, and runtime metadata for security vulnerabilities.

Community
Advanced
Ditto190Ditto190

security-scan

Automate security scanning of codebases to identify vulnerabilities and misconfigurations.

Community
Intermediate
blamejsblamejs

container-runtime-security

Audit Kubernetes Pod Security Standards and generate prioritized remediation plans.

Official
Advanced