container-security

When to Use

Reviewing Dockerfiles, docker-compose, K8s manifests, Helm charts, or "is this container secure"

CHECKLIST

Check	Sev	Pattern
Runs as root	CRIT	Missing USER or runAsUser: 0
ADD remote code	CRIT	ADD http (matches http/https)
Secrets in ENV/ARG	CRIT	Visible in docker history
Privileged container	CRIT	privileged: true
Docker socket mount	CRIT	/var/run/docker.sock
No securityContext	HIGH	K8s pod without securityContext
hostPath volume	HIGH	Data exfil risk
Dangerous caps	HIGH	SYS_ADMIN, NET_ADMIN, SYS_MODULE, SYS_RAWIO, DAC_OVERRIDE, SYS_PTRACE, SYS_CHROOT, NET_RAW, ALL
No health check	MED	Missing readiness/liveness
No resource limits	MED	Pod can exhaust node
latest tag	MED	Non-reproducible

OUTPUT

## Container Security: {scope}
### Summary
- Dockerfile: {N} | Compose: {N} | K8s: {N} | Image: {N}
### Issues
# CRITICAL: {type} in {file:line}
- Pattern: `{found}` → Fix: `{fix}`

Rules

1. USER FIRST. 2. Secrets in ENV/ARG = CRITICAL. 3. Multi-stage for prod. 4. Pin versions. 5. End: "Remaining risk: NONE/LOW/MED/HIGH (why)"

Anti-Rationalization

Rationalization	Red Flag	Verification
"root user en dev está OK"	Dockerfile sin USER / runAsUser: 0	CHECKLIST CRIT Runs as root + Rule USER FIRST
"latest tag en prod es práctico"	latest/: sin pin	CHECKLIST latest tag MED + Rule Pin versions
"secrets en env vars es suficiente"	Secrets en ENV/ARG visibles en history	CHECKLIST CRIT Secrets in ENV/ARG + grep ENV.*SECRET

Red Flags

• Skipping secrets scan → STOP, re-read skill
• Second occurrence of same rationalization → force RED zone

Verification

• grep -rn process.env + npm audit before commit
• cross-ref-check.ps1 → SKILL.md OK

Containers/IaC Playbook

Image: non-root USER 10001 + runAsNonRoot + readOnlyRootFilesystem Priv: privileged false | drop ALL + add min | no cap-add ALL | no hostNetwork/PID/sock Secrets: k8s Secret / mounts - never ENV/ARG (history) | tmpfs 0444 Tags/Scan: pin @sha256 digest - never :latest | trivy/grype in CI fail CRIT/HIGH Caps: drop ALL + add min | cap-add individual FORBIDDEN: NET_ADMIN, SYS_MODULE, SYS_RAWIO, DAC_OVERRIDE, SYS_PTRACE, SYS_CHROOT, SYS_BOOT, IPC_LOCK (any=HIGH) | SYS_MODULE = kernel module load = escape vector

changelog: odd/tasks/mejora-security.md (2026-09-18, slice 6) changelog: odd/tasks/mejora-security.md (2026-09-18, slice 4)

Refs

security-scanner · best-practices · quality-gate · auth-hardening · llm-security · infra-audit

docs/skills/container-security/reference.md