container-securitylisted

<!-- Native skill bundle for Claude Code. Generated by `secure-vibe dev regenerate`. --> <!-- Do not edit by hand; the source of truth is skills/container-security/SKILL.md. --> # Container Security Hardening for Dockerfiles, OCI images, Kubernetes manifests, and Helm charts. Use when generating a Dockerfile or image build, writing Kubernetes, Helm, or Kustomize manifests, or reviewing container changes in a pull request. ## ALWAYS - Use **multi-stage builds**: separate builder/test stages from the final runtime image so build toolchains and source aren't shipped. The last stage should be a minimal base — `gcr.io/distroless/<variant>`, `scratch`, or a versioned `-slim` / `-alpine` variant — pinned by SHA256 digest, not just tag. Two bases have nothing to pin: `scratch`, and a reference to an earlier stage in the same file (`FROM base`), which is pinned on that stage's own `FROM` line. - Run as a non-root user: set `USER` explicitly on the **final stage**, as a **number** not a name. Omitting it leaves the container running as root. K8s `runAsNonRoot` rejects UID 0 and cannot resolve a username, so `USER appuser` fails at startup with "image has non-numeric user"; any non-zero UID passes, and 10000+ by convention also avoids colliding with host accounts. - Use **`npm ci`** (and equivalents `pnpm install --frozen-lockfile`, `yarn install --frozen-lockfile`) in container builds, not `npm install`. `npm install` mutates the lockfile and resolves versions per-build, producing