/configure:container Skill

/configure:container

Check and configure comprehensive container infrastructure against project standards with emphasis on minimal images, non-root users, and security hardening.

When to Use This Skill

| Use this skill when... | Use another approach when... | |------------------------|------------------------------| | Auditing container infrastructure compliance (Dockerfile, workflows, scanning) | Writing a Dockerfile from scratch (/configure:dockerfile) | | Checking multi-stage builds, non-root users, and security hardening | Configuring Kubernetes deployments (/configure:skaffold) | | Setting up container build workflows with GHCR and multi-platform support | Running vulnerability scans on a built image (Trivy CLI directly) | | Verifying .dockerignore, OCI labels, and base image versions | Configuring devcontainer features for VS Code | | Adding Trivy/Grype scanning to CI pipelines | Debugging container runtime issues (system-debugging agent) |

Context

Dockerfiles: !find . -maxdepth 2 \( -name 'Dockerfile' -o -name 'Dockerfile.*' -o -name '*.Dockerfile' \)
Docker ignore: !find . -maxdepth 1 -name '.dockerignore'
Container workflows: !find . -path '*/.github/workflows/*' -maxdepth 3 \( -name '*container*' -o -name '*docker*' -o -name '*build*' \)
Devcontainer: !find . -path '*/.devcontainer/*' -maxdepth 2 -name 'devcontainer.json'
Skaffold: !find . -maxdepth 1 -name 'skaffold.yaml'
Package files: !find . -maxdepth 1 \( -name 'package.json' -o -name 'pyproject.toml' -o -name 'Cargo.toml' -o -name 'go.mod' \)
Project standards: !find . -maxdepth 1 -name '.project-standards.yaml'

Parameters

Parse from command arguments:

--check-only: Report compliance status without modifications (CI/CD mode)
--fix: Apply fixes automatically without prompting
--component <name>: Check specific component only (dockerfile, workflow, registry, scanning, devcontainer)

Security Philosophy

Minimal Attack Surface: Smaller images = fewer vulnerabilities. Use Alpine (~5MB) for Node.js, slim (~50MB) for Python.

Non-Root by Default: ALL containers MUST run as non-root users.

Multi-Stage Required: Separate build and runtime environments. Build tools and dev dependencies should NOT be in production images.

Execution

Execute this container infrastructure compliance check:

Step 1: Detect container-related files

Search for Dockerfile, workflow files, devcontainer config, and .dockerignore. Detect the project type (frontend, python, go, rust, infrastructure) from package files.

Step 2: Look up latest base image versions

Use WebSearch or WebFetch to verify current versions before flagging outdated images:

Node.js Alpine images: Check Docker Hub for latest LTS Alpine tags
Python slim images: Check Docker Hub for latest slim tags
nginx Alpine: Check Docker Hub for latest Alpine tags
GitHub Actions: Check release pages for latest action versions
Trivy: Check aquasecurity/trivy-action releases

Step 3: Analyze each component

Check each component against standards:

Components: Dockerfile (multi-stage, HEALTHCHECK, non-root user, .dockerignore with Dockerfile*, current minimal base), security hardening, build workflow (multi-platform, GHA cache, SHA-pinned scanner, id-token: write), and OCI labels. Missing multi-stage/HEALTHCHECK/non-root/workflow or secrets in image = FAIL; most others WARN; runtime hardening flags INFO.

For the full check tables, severities, and base-image targets, read references/compliance-standards.md while analyzing each component.

Run /configure:dockerfile for detailed Dockerfile checks if needed.

Step 4: Generate compliance report

Print a formatted compliance report:

Container Infrastructure Compliance Report
==============================================
Project Type: frontend (detected)

Component Status:
  Dockerfile              PASS
  Build Workflow          PASS
  Registry Config         PASS
  Container Scanning      WARN (missing)
  Devcontainer           SKIP (not required)
  .dockerignore          PASS

Dockerfile Checks:
  Multi-stage             2 stages          PASS
  HEALTHCHECK             Present           PASS
  Base images             node:24, nginx    PASS

Build Workflow Checks:
  Workflow                container-build.yml PASS
  checkout                v4                PASS
  build-push-action       v6                PASS
  Multi-platform          amd64,arm64       PASS
  GHA caching             Enabled           PASS

Container Labels Checks:
  image.source            In metadata-action PASS
  image.description       Custom label set  PASS
  image.licenses          Not configured    WARN

Recommendations:
  - Add org.opencontainers.image.licenses label to workflow
  - Add Trivy or Grype vulnerability scanning to CI

Overall: 2 warnings, 1 info

If --check-only, stop here.

Step 5: Apply fixes (if --fix or user confirms)

Missing Dockerfile: Run /configure:dockerfile --fix
Missing build workflow: Create from template in REFERENCE.md
Missing scanning: Add Trivy scanning job
Missing .dockerignore: Create standard .dockerignore from REFERENCE.md
Outdated actions: Update version numbers

Step 6: Update standards tracking

Update .project-standards.yaml:

components:
  container: "2025.1"
  dockerfile: "2025.1"
  container-workflow: "2025.1"

For detailed templates (Dockerfile, workflow, devcontainer, .dockerignore), see REFERENCE.md.

Agentic Optimizations

| Context | Command | |---------|---------| | Quick compliance check | /configure:container --check-only | | Auto-fix all issues | /configure:container --fix | | Dockerfile only | /configure:container --check-only --component dockerfile | | Workflow only | /configure:container --check-only --component workflow | | Scanning only | /configure:container --fix --component scanning | | Find all Dockerfiles | find . -maxdepth 2 \( -name 'Dockerfile' -o -name 'Dockerfile.*' \) 2>/dev/null |

Flags

| Flag | Description | |------|-------------| | --check-only | Report status without offering fixes | | --fix | Apply fixes automatically | | --component <name> | Check specific component only (dockerfile, workflow, registry, scanning, devcontainer) |

Component Dependencies

Container Infrastructure
├── Dockerfile (required)
│   └── .dockerignore (recommended)
├── Build Workflow (required for CI/CD)
│   ├── Registry config
│   └── Multi-platform builds
├── Container Scanning (recommended)
│   └── SBOM generation (optional)
└── Devcontainer (optional)
    └── VS Code extensions

Notes

Multi-platform builds: Essential for M1/M2 Mac developers and ARM servers
GHCR: GitHub Container Registry is preferred for GitHub-hosted projects
Trivy: Recommended scanner for comprehensive vulnerability detection
Alpine vs Slim: Use Alpine for Node.js/Go/Rust. Use slim (Debian) for Python (musl compatibility issues)
Non-root is mandatory: Never run containers as root in production
Version pinning: Always use specific version tags, never latest

Agent Skills: /configure:container

Install this agent skill to your local

Skill Files