Skill UI

This comprehensive guide details security best practices for hardening Docker containers and their underlying infrastructure (daemon, runtime, images). It aligns with standards like the CIS Docker Benchmark v1.8.0, enforcing least privilege through non-root users, capability dropping, read-only filesystems, and advanced security profiles (seccomp/AppArmor). Essential for building highly secure, compliant, and production-ready container environments.

This guide details how to harden the Docker daemon configuration using daemon.json. It implements critical security measures such as user namespace remapping, disabling inter-container communication (ICC), enforcing no-new-privileges, and setting up TLS client authentication. Use this when aiming to prevent container breakout, privilege escalation, or meeting CIS benchmark compliance requirements.

Utilizes Google Distroless images and multi-stage Docker builds to drastically reduce container attack surface. By eliminating unnecessary OS components like shells, package managers, and core utilities, this technique is essential for hardening container security, meeting compliance requirements, or mitigating risks associated with bloated base images.

This comprehensive guide provides best practices for hardening container images, dramatically minimizing the attack surface in production environments. It covers advanced techniques such as implementing multi-stage builds, using distroless images, running containers as non-root users, and configuring read-only filesystems. Adherence to CIS Docker Benchmark and secure DevSecOps practices are key focuses.

This tool runs the open-source Docker Bench for Security, auditing container host configurations, Docker daemon settings, and runtime security controls against the CIS Benchmark. It generates a detailed pass/fail/warn report, helping security teams validate compliance, harden environments, and perform regular security audits.

Integrates Aqua Security's Trivy scanner into CI/CD pipelines to perform automated vulnerability scanning on Docker images and related artifacts. It detects OS package CVEs, application dependency issues, and Dockerfile misconfigurations. This ensures that only secure, compliant images can proceed to registry push or production deployment by enforcing strict quality gates.

Trivy is an open-source scanner for comprehensive security auditing of container images. It detects vulnerabilities in OS packages, language dependencies, misconfigurations, exposed secrets, and license violations. It is essential for integrating security checks into CI/CD pipelines, performing rigorous security assessments, or conducting incident response investigations. Supports generating SBOMs and reporting in formats like SARIF and CycloneDX.

Utilize Modal, a serverless GPU cloud, for running complex machine learning workloads, including training, fine-tuning, and inference. This tool provides a zero-config environment, eliminating the need for SSH setup or Docker management. It features automatic scale-to-zero billing and local-first execution, making high-powered GPU compute accessible for debugging and small-scale experiments.

A comprehensive guide for setting up production-grade CI/CD pipelines for Go projects using GitHub Actions. This skill covers essential quality gates including unit testing, linting (golangci-lint), static analysis security testing (SAST), vulnerability scanning, dependency management, Docker builds, and automated releases using GoReleaser.

This comprehensive template and guide facilitate the containerization of ASP.NET Core applications. It provides a structured prompt and checklist to ensure that the resulting Dockerfile adheres to industry best practices for performance, security, and maintainability when running on Linux containers. It covers all necessary aspects, including dependency management, port exposure, build stages, and custom configuration.

This guide provides a comprehensive, step-by-step process to scaffold a modern Spring Boot application using Kotlin. It covers downloading the template, configuring dependencies (including SpringDoc and ArchUnit), and setting up complex polyglot environments using Docker Compose. Supports PostgreSQL, MongoDB, Redis, and WebFlux reactive programming.

Helps produce Dockerfiles and a detailed containerization plan for ASP.NET .NET Framework projects running in Windows containers, covering configuration settings, IIS, dependencies, and deployment steps.