container-securitylisted

<!-- Native skill bundle for Claude Code. Generated by `secure-vibe dev regenerate`. --> <!-- Do not edit by hand; the source of truth is skills/container-security/SKILL.md. --> # Container Security Hardening rules for Dockerfile, OCI images, Kubernetes manifests, and Helm charts ## ALWAYS - Use **multi-stage builds**: separate builder/test stages from the final runtime image so build toolchains and source aren't shipped. The last stage should be `FROM distroless`, `FROM scratch`, `FROM alpine:<digest>`, or another minimal base — pinned by SHA256 digest, not just tag. - Run as a non-root user: `USER <uid>` (numeric UID >= 10000 for K8s `runAsNonRoot` policies to be enforceable). Set USER explicitly on the **final stage** — omitting USER entirely leaves the container running as root by default, which is the same as `USER root`. - Use **`npm ci`** (and equivalents `pnpm install --frozen-lockfile`, `yarn install --frozen-lockfile`) in container builds, not `npm install`. `npm install` mutates the lockfile and resolves versions per-build, producing non-deterministic images that drift from the lockfile. - Add a `.dockerignore` excluding `.git`, `node_modules`, `.env`, `*.pem`, `*.key`, `target/`, `.terraform/`, `dist/`, `coverage/`. - Enable **BuildKit** (`DOCKER_BUILDKIT=1` or `# syntax=docker/dockerfile:1`) for `--mount=type=secret` support and better cache isolation. - Emit an **SBOM** (`docker buildx --sbom=true` / `syft`) and attach it to the image so downstream scanners