setup-container-security

# Setup Container Security Harden a project's container image against supply-chain attack: pin the base, verify what you fetch, drop privileges, and scan what you ship. **OCI-compliant first** — target the OCI image spec so the artifact runs on any conformant runtime (podman, Docker, containerd). Build and test distributable images with **podman** (rootless, daemonless, OCI output by default), and stay Docker-compatible (`Dockerfile`/`Containerfile` are interchangeable below). ## When to Use - When a project builds a container image (has a `Containerfile`/`Dockerfile`) - Before publishing an image to a registry (a project that ships the image as a release artifact) - When auditing container security, or when a supply-chain review flags container gaps ## Required Inputs 1. The project's `Containerfile`/`Dockerfile`(s) 2. Base image(s) and target registry 3. Whether the project **publishes** the image (ships it as a release artifact) — gates SBOM-as-release-asset + signing, delegated to `wrapup-sprint` ## The Threat A container bakes in a base image, fetched packages/binaries, and a runtime user. A mutable base tag can be repointed upstream; an unverified `curl … | install` can be swapped; a root runtime turns any escape into host-level access. Hardening: **pin, verify, minimize, drop privileges, scan.** ## Workflow ### Step 1: Triage ```bash ls Containerfile Dockerfile **/Dockerfile 2>/dev/null # Mutable base tags (should be digest-pinned): grep -nE '^FROM .*:[^@]*$'...