Skill UI

A comprehensive guide for securing container images and runtime environments. Covers best practices from Dockerfile authoring (minimal base images, multi-stage builds, non-root users) through advanced runtime enforcement (seccomp, AppArmor) and Kubernetes security controls. Essential for production hardening and maintaining supply chain integrity.

This tool audits Kubernetes Role-Based Access Control (RBAC) configurations to systematically identify overly permissive roles, dangerous wildcards, and insecure ClusterRoleBindings. It helps pinpoint potential privilege escalation paths, service account abuses, and compliance gaps in EKS, GKE, and AKS clusters, ensuring adherence to the principle of least privilege.

A comprehensive security auditing tool designed to identify over-permissive Role-Based Access Control (RBAC) roles and potential service-account token abuse paths within a Kubernetes cluster. It systematically reviews cluster bindings, effective permissions, and common escalation primitives using advanced tools like `kubectl auth can-i`, `rbac-police`, and `rakkess`, ensuring adherence to the principle of least privilege.

kube-bench is an open-source tool that validates the compliance and security posture of Kubernetes clusters. It rigorously checks control-plane components, worker nodes, and cluster policies against the comprehensive CIS Kubernetes Benchmark. It reports findings (PASS/FAIL/WARN) and includes specific remediation guidance, making it essential for compliance auditing and hardening efforts.

Falco is a powerful CNCF project for real-time runtime security monitoring. This guide teaches authors how to write and deploy custom detection rules using Falco's robust YAML rule engine and modern eBPF driver. It is designed to detect critical threats such as container escapes, namespace manipulation, privileged mounts, and anomalous syscalls in Kubernetes and Docker environments, significantly hardening the overall container security posture.

Trivy is an open-source, comprehensive scanner used to find vulnerabilities (CVEs), misconfigurations, secrets, and license issues across multiple targets. It is essential for implementing 'shift-left' security gates in CI/CD pipelines, scanning container images, Infrastructure-as-Code (IaC) like Terraform/Kubernetes, and generating/re-scanning SBOMs for supply chain transparency.