secure-container-build

Build secure container images with Wolfi glibc-dynamic runtime and multi-stage builds.

5|Updated Nov 6, 2025

Search Tags:#security #container #multistage #podman #wolfi #rootless

Ready to run

npx skills add https://github.com/pigfoot/claude-code-hubs --skill secure-container-build

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: secure-container-build
Source: https://github.com/pigfoot/claude-code-hubs/tree/main/plugins/secure-container-build/skills/secure-container-build
Command: npx skills add https://github.com/pigfoot/claude-code-hubs --skill secure-container-build

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes assets (resource) components.

What problem does it solve?

This Skill guides building secure, minimal container images using Wolfi runtime, multi-stage builds, and a non-root user by default, reducing attack surface and runtime footprint.

Core Features & Use Cases

Wolfi glibc-dynamic runtime with non-root UID for secure execution
Multi-stage builds to minimize runtime image size
Init with tini to handle signals and proper process supervision
Templates for common stacks: Python/uv, Bun, Node.js/pnpm, Golang (static/CGO), Rust (glibc/musl)
Allocator optimization options for Rust containers
CI/CD-ready templates and best practices

Quick Start

Copy the Containerfile templates from assets (for the desired runtime) and adjust the RUNTIME_TAG, then build with Podman, splitting builder and runtime stages.

Frequently Asked Questions about secure-container-build

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I build secure container images with minimal runtime size?▼

Build secure container images using Wolfi glibc-dynamic runtime with multi-stage builds to separate builder and runtime stages. This approach minimizes runtime footprint while running as a non-root user (UID 65532) by default, reducing attack surface and image bloat.

Can I use multi-stage builds with Python, Node.js, Golang, and Rust projects?▼

Yes. Multi-stage build templates support Python/uv, Bun, Node.js/pnpm, Golang (static and CGO), and Rust (glibc and musl). Each template is optimized for its runtime, with cache-aware BuildKit patterns and allocator options for specialized needs.

What's the best way to configure a non-root user in container images?▼

Configure containers to run as a non-root user by setting UID 65532 in the runtime stage. Combine this with Wolfi base images and tini init to handle signals properly, ensuring secure, production-ready execution without privilege escalation risk.

How do I handle process supervision and signal handling in containers?▼

Use tini as an init system within your container's runtime stage to properly manage signals and child processes. This prevents zombie processes and ensures graceful shutdown, critical for production workloads across all supported runtimes.

Does Podman work with these multi-stage Containerfile templates?▼

Yes. These Containerfile templates are built for Podman and leverage BuildKit cache-optimization patterns. Podman's rootless mode aligns with the non-root user configuration, enhancing security during both build and runtime.

When should I use allocator optimization for Rust containers?▼

Apply allocator optimization options when building Rust containers to reduce memory overhead and improve performance in resource-constrained environments. Choose between glibc and musl runtime variants based on your deployment context and compatibility needs.