configure-container（配置容器）

/configure:container

Check and configure comprehensive container infrastructure against project standards with emphasis on minimal images, non-root users, and security hardening.

When to Use This Skill

Context

• Dockerfiles:!find. -maxdepth 2 \(-name 'Dockerfile' -o -name 'Dockerfile.*' -o -name '*.Dockerfile' \)
• Docker ignore:!find. -maxdepth 1 -name '.dockerignore'
• Container workflows:!find.github/workflows -maxdepth 1 \(-name '*container*' -o -name '*docker*' -o -name '*build*' \)
• Devcontainer:!find.devcontainer -maxdepth 1 -name 'devcontainer.json'
• Skaffold:!find. -maxdepth 1 -name 'skaffold.yaml'
• Package files:!find. -maxdepth 1 \(-name 'package.json' -o -name 'pyproject.toml' -o -name 'Cargo.toml' -o -name 'go.mod' \)
• Project standards:!find. -maxdepth 1 -name '.project-standards.yaml'

Parameters

Parse from command arguments:

• --check-only: Report compliance status without modifications (CI/CD mode)
• --fix: Apply fixes automatically without prompting
• --component <name>: Check specific component only (dockerfile, workflow, registry, scanning, devcontainer)

Security Philosophy

Minimal Attack Surface: Smaller images = fewer vulnerabilities. Use Alpine (~5MB) for Node.js, slim (~50MB) for Python.

Non-Root by Default: ALL containers MUST run as non-root users.

Multi-Stage Required: Separate build and runtime environments. Build tools and dev dependencies should NOT be in production images.

Execution

Execute this container infrastructure compliance check:

Step 1: Detect container-related files

Search for Dockerfile, workflow files, devcontainer config, and .dockerignore. Detect the project type (frontend, python, go, rust, infrastructure) from package files.

Step 2: Look up latest base image versions

Use WebSearch or WebFetch to verify current versions before flagging outdated images:

1. Node.js Alpine images: Check Docker Hub for latest LTS Alpine tags
2. Python slim images: Check Docker Hub for latest slim tags
3. nginx Alpine: Check Docker Hub for latest Alpine tags
4. GitHub Actions: Check release pages for latest action versions
5. Trivy: Check aquasecurity/trivy-action releases

Step 3: Analyze each component

Check each component against standards:

Dockerfile Standards:

Base Image Standards (verify latest before reporting):

Security Hardening Standards:

Build Workflow Standards:

Container Labels Standards (GHCR Integration):

Run /configure:dockerfile for detailed Dockerfile checks if needed.

Step 4: Generate compliance report

Print a formatted compliance report:

Container Infrastructure Compliance Report
==============================================
Project Type: frontend (detected)

Component Status:
  Dockerfile              PASS
  Build Workflow          PASS
  Registry Config         PASS
  Container Scanning      WARN (missing)
  Devcontainer           SKIP (not required)
  .dockerignore          PASS

Dockerfile Checks:
  Multi-stage             2 stages          PASS
  HEALTHCHECK             Present           PASS
  Base images             node:22, nginx    PASS

Build Workflow Checks:
  Workflow                container-build.yml PASS
  checkout                v4                PASS
  build-push-action       v6                PASS
  Multi-platform          amd64,arm64       PASS
  GHA caching             Enabled           PASS

Container Labels Checks:
  image.source            In metadata-action PASS
  image.description       Custom label set  PASS
  image.licenses          Not configured    WARN

Recommendations:
  - Add org.opencontainers.image.licenses label to workflow
  - Add Trivy or Grype vulnerability scanning to CI

Overall: 2 warnings, 1 info

If --check-only, stop here.

Step 5: Apply fixes (if --fix or user confirms)

1. Missing Dockerfile: Run /configure:dockerfile --fix
2. Missing build workflow: Create from template in REFERENCE.md
3. Missing scanning: Add Trivy scanning job
4. Missing.dockerignore: Create standard.dockerignore from REFERENCE.md
5. Outdated actions: Update version numbers

Step 6: Update standards tracking

Update .project-standards.yaml:

components:
  container: "2025.1"
  dockerfile: "2025.1"
  container-workflow: "2025.1"

For detailed templates (Dockerfile, workflow, devcontainer,.dockerignore), see REFERENCE.md.

Agentic Optimizations

Flags

Component Dependencies

Container Infrastructure
├── Dockerfile (required)
│   └── .dockerignore (recommended)
├── Build Workflow (required for CI/CD)
│   ├── Registry config
│   └── Multi-platform builds
├── Container Scanning (recommended)
│   └── SBOM generation (optional)
└── Devcontainer (optional)
    └── VS Code extensions

Notes

• Multi-platform builds: Essential for M1/M2 Mac developers and ARM servers
• GHCR: GitHub Container Registry is preferred for GitHub-hosted projects
• Trivy: Recommended scanner for comprehensive vulnerability detection
• Alpine vs Slim: Use Alpine for Node.js/Go/Rust. Use slim (Debian) for Python (musl compatibility issues)
• Non-root is mandatory: Never run containers as root in production
• Version pinning: Always use specific version tags, never latest

See Also

• /configure:dockerfile - Dockerfile-specific configuration
• /configure:workflows - GitHub Actions workflow configuration
• /configure:skaffold - Kubernetes development configuration
• /configure:security - Security scanning configuration
• /configure:all - Run all compliance checks
• container-development skill - Container best practices
• ci-workflows skill - CI/CD workflow patterns