Container and Image Security

Pathrule2 Rules • 1 Memory • 2 Skills

Container and image security starts before a registry pull and continues through admission and runtime. This bundle covers pinned inputs, secret-free builds, provenance and signature verification, vulnerability triage, base-image refresh, and least-power runtime settings. Unlike Docker Containers, it focuses on supply-chain trust and compromise containment rather than general Dockerfile construction and container lifecycle conventions.

Suggested path map

Pathrule places each piece on the matching path, so your assistant only sees it where it belongs. This is the scoping you get on import; you can adjust it in your workspace.

/ workspace root

review-container-image

deploy/

Pin every image input by immutable digest

A signature is useful only with an identity policy

k8s/

Run containers with the least kernel authority

.github/

workflows/

refresh-container-base

Rules

Pin every image input by immutable digest/deployhighstrictBase, tool, and deployment images resolve to reviewed digests rather than mutable tags.

1	Base, tool, and deployment images resolve to reviewed digests rather than mutable tags. A tag can point to different bytes between build, test, and production, invalidating review and making rollback ambiguous. Enforce this boundary in /deploy so invalid work stops before it reaches another subsystem or creates an externally visible side effect.
2
3	- Keep the human-readable tag as an annotation, but make the digest the value used by builds and deployments.
4	- Update digests through an automated change that includes upstream release notes, scan results, and rebuild impact.
5	- Reject floating tags in Dockerfiles, compose files, build actions, and workload manifests.
6	- Record the digest of every stage, including build-only and migration images.
7
8	Verification: Re-resolve all declared tags and confirm the reviewed digest is the one built and admitted; change a tag upstream and prove deployment bytes do not drift.

Run containers with the least kernel authority/k8shighstrictWorkloads drop unnecessary privileges, capabilities, writes, and host integration at admission time.

1	Workloads drop unnecessary privileges, capabilities, writes, and host integration at admission time. A small application vulnerability becomes a host or cluster compromise when the container runs as root, writes its image, or reaches host namespaces. Enforce this boundary in /k8s so invalid work stops before it reaches another subsystem or creates an externally visible side effect.
2
3	- Require a non-root user, disable privilege escalation, drop capabilities by default, and add back only reviewed needs.
4	- Use a read-only root filesystem and explicit writable volumes for the few paths that need state.
5	- Block privileged mode, host PID, host network, host paths, and unrestricted device access unless a security-owned exception exists.
6	- Apply CPU, memory, process, and ephemeral-storage limits so compromise cannot become node-wide exhaustion.
7
8	Verification: Deploy a deliberately over-privileged fixture and confirm admission rejects it; run the real workload under the final policy and exercise startup, shutdown, and maintenance paths.

Memories

A signature is useful only with an identity policy/deployCryptographic verification must identify the signer and the approved build context, not merely report that bytes have a signature.

1	Cryptographic verification must identify the signer and the approved build context, not merely report that bytes have a signature. A valid signature proves a key or identity signed bytes, but trust comes from checking who signed, for which repository, through which builder, and from what source revision.
2
3	Bind admission to the expected issuer, subject, source repository, workflow, and immutable artifact digest. Store provenance beside the image and make the deployment verify it rather than trusting a CI badge. Keep emergency unsigned admission separate, time-bound, and observable because a blanket bypass removes the value of signing. Keep the decision explicit at /deploy; moving it into an incidental caller makes behavior depend on which route happened to execute first.
4
5	See /.github/workflows for provenance production and /k8s for the admission boundary. That related boundary consumes this decision and carries the evidence that proves it still holds.

Skills

review-container-image/rootReview one container image for provenance, contents, vulnerabilities, and runtime permissions before release.

1	---
2	name: review-container-image
3	description: Review one container image for provenance, contents, vulnerabilities, and runtime permissions before release.
4	---
5
6	# Review Container Image
7
8	Run this procedure whenever the governed surface changes or its operational evidence becomes stale.
9
10	1. Resolve the deployed digest and verify its signature and provenance against the approved builder, repository, workflow, and source revision.
11	2. Inspect layers and the final filesystem for package managers, shells, compilers, credentials, private keys, tokens, and files copied from an unintended build context.
12	3. Review vulnerabilities by reachable component, exploit conditions, available fix, and compensating controls instead of accepting a severity count alone.
13	4. Launch the image with production user, filesystem, capability, network, and resource settings; exercise health, shutdown, and maintenance behavior.
14
15	Record the decision, failed checks, and follow-up owner with the change. A successful run leaves reproducible evidence that another reviewer can inspect without repeating the investigation from memory.

refresh-container-base/.github/workflowsRefresh pinned base images with rebuild evidence, compatibility tests, and an auditable digest change.

1	---
2	name: refresh-container-base
3	description: Refresh pinned base images with rebuild evidence, compatibility tests, and an auditable digest change.
4	---
5
6	# Refresh Container Base
7
8	Run this procedure whenever the governed surface changes or its operational evidence becomes stale.
9
10	1. Resolve the upstream release to an immutable digest and collect its changelog, end-of-support status, and published security information.
11	2. Rebuild without cache, generate a software bill of materials and provenance, then compare packages and image size with the current release.
12	3. Run application, integration, and runtime-policy tests on the candidate image, including non-root startup and read-only filesystem behavior.
13	4. Promote only the reviewed digest, retain the prior known-good digest for rollback, and record why any unfixed reachable vulnerability is accepted.
14
15	Record the decision, failed checks, and follow-up owner with the change. A successful run leaves reproducible evidence that another reviewer can inspect without repeating the investigation from memory.

Why this pattern

Agents optimize for a working image, then pull mutable tags, leak build credentials into layers, ignore provenance, or grant runtime privileges the workload never needs.

Built for Teams building, publishing, admitting, and operating OCI container images.

Keeps your assistant from:

Mutable base images that change without code review
Secrets and build tools left in published layers
Signed but vulnerable images admitted with excessive runtime privileges

View as markdown

License: Apache-2.0
Version: 1.0.0
Updated: 2026-08-25