containerization-assistant — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited containerization-assistant (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Generate production-ready Docker and Kubernetes configurations for your applications.
For existing templates:
# Node.js application
cp assets/Dockerfile.nodejs ./Dockerfile
# Python application
cp assets/Dockerfile.python ./Dockerfile
# Java application (Spring Boot)
cp assets/Dockerfile.java ./Dockerfile
# Go application
cp assets/Dockerfile.go ./DockerfileFor custom generation: Describe your application stack and requirements, and a custom Dockerfile will be generated.
# Multi-service application template
cp assets/docker-compose.yml ./
cp assets/.env.example ./.env
# Edit .env with your configurationKubernetes configurations are generated based on your deployment requirements. See [kubernetes_patterns.md](references/kubernetes_patterns.md) for complete examples.
Node.js (assets/Dockerfile.nodejs):
Python (assets/Dockerfile.python):
Java (assets/Dockerfile.java):
Go (assets/Dockerfile.go):
Multi-service stack (assets/docker-compose.yml):
Environment template (assets/.env.example):
Identify:
Template-based:
Custom generation:
Dockerfile customization:
# Update base image version
FROM node:18-alpine # Change version as needed
# Add build arguments
ARG NODE_ENV=production
# Modify exposed port
EXPOSE 3000 # Change to your port
# Update startup command
CMD ["node", "server.js"] # Change to your entry pointDocker Compose customization:
services:
web:
build:
context: .
dockerfile: Dockerfile
ports:
- "3000:3000" # Change port mapping
environment:
- DATABASE_URL=${DATABASE_URL} # Add environment variables# Build Docker image
docker build -t myapp:1.0.0 .
# Test locally
docker run -p 3000:3000 myapp:1.0.0
# Test with Docker Compose
docker-compose up -d
# View logs
docker-compose logs -f
# Stop services
docker-compose downSee [dockerfile_best_practices.md](references/dockerfile_best_practices.md) for:
Requirements: Node.js 18, PostgreSQL database, Redis cache
Steps:
Dockerfile.nodejs templatedocker-compose.yml for local developmentGenerated files:
Dockerfile - Multi-stage Node.js builddocker-compose.yml - Web, PostgreSQL, Redis services.env - Configuration variables.dockerignore - Exclude unnecessary filesRequirements: Python 3.11, PostgreSQL, Celery workers
Steps:
Dockerfile.python templateGenerated files:
Dockerfile - Multi-stage Python builddocker-compose.yml - Web, PostgreSQL, Redis, Celerycelery-worker.Dockerfile - Celery worker image.env - Database and Celery configurationRequirements: Deploy containerized app to Kubernetes with scaling
Steps:
See [kubernetes_patterns.md](references/kubernetes_patterns.md) for complete examples.
Requirements: Multiple services (API, Auth, Workers) with shared database
Steps:
Generated structure:
services/
api/
Dockerfile
auth/
Dockerfile
worker/
Dockerfile
docker-compose.yml
.envReduce image size by separating build and runtime:
# Build stage
FROM node:18-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build
# Production stage
FROM node:18-alpine
WORKDIR /app
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
CMD ["node", "dist/index.js"]# Use non-root user
RUN addgroup -g 1001 -S nodejs && \
adduser -S nodejs -u 1001 -G nodejs
USER nodejs
# Use specific versions
FROM node:18.17.0-alpine # Not 'latest'
# Scan for vulnerabilities
# docker scan myapp:latest# Order layers from least to most frequently changing
COPY package*.json ./ # Changes less often
RUN npm ci
COPY . . # Changes more often
# Use .dockerignore
# node_modules
# .git
# *.mdFor comprehensive best practices, see [dockerfile_best_practices.md](references/dockerfile_best_practices.md).
apiVersion: apps/v1
kind: Deployment
metadata:
name: myapp
spec:
replicas: 3
selector:
matchLabels:
app: myapp
template:
spec:
containers:
- name: myapp
image: myapp:1.0.0
resources:
requests:
memory: "256Mi"
cpu: "250m"
limits:
memory: "512Mi"
cpu: "500m"apiVersion: v1
kind: Service
metadata:
name: myapp-service
spec:
type: ClusterIP
selector:
app: myapp
ports:
- port: 80
targetPort: 8080
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: myapp-ingress
annotations:
cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
tls:
- hosts:
- myapp.example.com
secretName: myapp-tls
rules:
- host: myapp.example.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: myapp-service
port:
number: 80For complete Kubernetes patterns including ConfigMaps, Secrets, StatefulSets, Jobs, and more, see [kubernetes_patterns.md](references/kubernetes_patterns.md).
Development (.env):
NODE_ENV=development
DATABASE_URL=postgresql://localhost/myapp_dev
DEBUG=trueProduction (Kubernetes Secret):
apiVersion: v1
kind: Secret
metadata:
name: myapp-secrets
type: Opaque
stringData:
database_url: "postgresql://prod-db/myapp"
api_key: "secret-key"apiVersion: v1
kind: ConfigMap
metadata:
name: myapp-config
data:
log_level: "info"
feature_flags: |
{
"new_ui": true,
"beta_features": false
}Problem: Build fails with permission errors
Solution:
RUN chown -R appuser:appuser /app
USER appuserProblem: Image too large
Solution:
Problem: Container exits immediately
Solution:
docker logs <container>Problem: Cannot connect to container
Solution:
-p 3000:30000.0.0.0, not localhostProblem: Pod stuck in Pending state
Solution:
kubectl describe pod <pod-name>
# Check events for resource constraints or image pull issuesProblem: Pod crashes with OOMKilled
Solution:
resources:
limits:
memory: "512Mi" # Increase memory limitSee [dockerfile_best_practices.md](references/dockerfile_best_practices.md) for:
See [kubernetes_patterns.md](references/kubernetes_patterns.md) for:
GitHub Actions:
name: Build and Push Docker Image
on:
push:
branches: [main]
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Build Docker image
run: docker build -t myapp:${{ github.sha }} .
- name: Push to registry
run: |
echo ${{ secrets.DOCKER_PASSWORD }} | docker login -u ${{ secrets.DOCKER_USERNAME }} --password-stdin
docker push myapp:${{ github.sha }}Push to Docker Hub:
docker tag myapp:1.0.0 username/myapp:1.0.0
docker push username/myapp:1.0.0Push to AWS ECR:
aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin 123456789.dkr.ecr.us-east-1.amazonaws.com
docker tag myapp:1.0.0 123456789.dkr.ecr.us-east-1.amazonaws.com/myapp:1.0.0
docker push 123456789.dkr.ecr.us-east-1.amazonaws.com/myapp:1.0.0For complex Kubernetes deployments, consider using Helm charts for templated manifests and version management.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.