Build a small, safe container for Kubernetes: multi-stage with a distroless/minimal base, non-root UID, digest-pinned base, dropped Linux capabilities, and a read-only root filesystem.
Installs into .claude/skills of the current project.
Are you the author of Container Hardening K8s?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/mcorbett51090-container-hardening-k8s)
---
name: container-hardening-k8s
description: "Build a small, safe container for Kubernetes: multi-stage with a distroless/minimal base, non-root UID, digest-pinned base, dropped Linux capabilities, and a read-only root filesystem."
---
# Container Hardening (k8s)
## Build
Multi-stage: build in one stage, copy the artifact into a **distroless/minimal** runtime. No compiler/shell in runtime.
## Run safely
- **non-root** UID
- **drop** all Linux capabilities (add back only what's needed)
- **read-only** root filesystem
- base pinned by **digest**
## Why
Every package is a CVE + attack surface. Distroless quiets most scans by construction. Read-only FS + dropped caps shrink blast radius cheaply. Route the residual CVE verdict to `security-engineering`.
