creator/Anthropic-Cybersecurity-Skills
1
0
Fork 0
mirror of https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git synced 2026-07-13 19:05:17 +03:00
Code Issues Packages Projects Releases Wiki Activity

Initial commit - 611 cybersecurity skills across all subdomains

Browse Source
This commit is contained in:
mukul975
2026-02-25 10:47:44 +01:00
commit 22a7ab1462
1765 changed files with 280648 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/performing-container-image-hardening/references/workflows.md
+56
View File
@@ -0,0 +1,56 @@
# Workflow Reference: Container Image Hardening
## Hardening Pipeline
```
Base Image Selection
│
▼
┌──────────────────┐
│ Multi-Stage Build │
│ (builder + prod) │
└──────┬───────────┘
│
▼
┌──────────────────┐
│ Remove Packages │
│ + Set User/Perms │
└──────┬───────────┘
│
▼
┌──────────────────┐
│ Trivy Scan │
│ + Hadolint │
└──────┬───────────┘
│
▼
┌──────────────────┐
│ CIS Benchmark │
│ Validation │
└──────────────────┘
```
## Base Image Selection Guide
| Base Image | Size | Use Case | Packages |
|------------|------|----------|----------|
| scratch | 0 MB | Static Go/Rust binaries | None |
| distroless/static | 2 MB | Static binaries + CA certs | ca-certificates |
| distroless/base | 20 MB | Dynamic binaries | glibc, libssl |
| alpine:3.19 | 7 MB | General minimal | musl, busybox |
| debian:bookworm-slim | 80 MB | Debian ecosystem | apt, glibc |
| ubuntu:24.04 | 78 MB | Ubuntu ecosystem | apt, glibc |
## Dockerfile Hardening Checklist
- [ ] Multi-stage build separates build and runtime
- [ ] Minimal base image selected
- [ ] Non-root USER instruction present
- [ ] HEALTHCHECK instruction defined
- [ ] Base image pinned by digest
- [ ] COPY used instead of ADD
- [ ] No secrets in ENV or ARG
- [ ] Package cache cleaned (rm -rf /var/lib/apt/lists/*)
- [ ] Unnecessary packages removed
- [ ] setuid/setgid bits cleared
- [ ] Shell removed (if not needed)