setup-container-security

Container hardening secures images by pinning base images by digest, verifying artifact fetches, and enforcing non-root runtimes. This Skill automates those practices alongside SBOM scanning to protect projects before publication to a registry.

You can generate an SBOM and scan for CVEs using grype and syft. This Skill orchestrates both tools to validate the built image's software bill of materials and identify vulnerabilities before the image is published.

Pinning base images by digest guarantees you pull the exact, verified image version rather than a mutable tag. This prevents supply-chain attacks where a registry tag is silently updated with malicious or vulnerable layers.

Yes, grype and syft are required dependencies for this Skill. Grype handles CVE vulnerability scanning while syft generates the SBOM needed to validate the software supply chain of your built container images.

Yes, this container security hardening applies to any project that builds container images. It standardizes supply-chain security practices, making it suitable for diverse codebases aiming to secure images before registry publication.

The best way to secure container images combines digest-pinning for base images, verified artifact fetches, non-root runtimes, and automated SBOM scanning. This Skill integrates these hardening practices to mitigate supply-chain attacks.