skills.rest
MARUCIE
MARUCIECOMMUNITY
Explore all skills by this author →
GitHub

containerization

Writes and audits Dockerfiles, docker-compose setups, and Kubernetes manifests with security baselines.

1|Updated Mar 18, 2026
Search Tags:#devops#kubernetes#docker#container security#helm#dockerfile#docker-compose
One-click install
npx skills add https://github.com/MARUCIE/openclaw-foundry --skill containerization-marucie
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: containerization
Source: https://github.com/MARUCIE/openclaw-foundry/tree/main/web/public/packs/spellbook-security-auditor/skills/containerization
Command: npx skills add https://github.com/MARUCIE/openclaw-foundry --skill containerization-marucie

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Teams packaging services with Docker and Kubernetes often ship images running as root, oversized base images, missing resource limits, and insecure pod configurations. This Skill provides production-oriented patterns and audit checklists for Dockerfiles, docker-compose, Kubernetes resources, and Helm charts so deployments avoid common high-risk misconfigurations. ## Core Features & Use Cases - Dockerfile Best Practices: Multi-stage build templates for Python, Node.js, and Go, layer caching order, .dockerignore setup, and base image selection guidance. - Kubernetes Manifests: Ready-to-adapt Deployment, Service, Ingress, ConfigMap/Secret, HPA, and securityContext configurations with resource sizing and probe tuning guidance. - Security Auditing: Baselines for non-root users, read-only root filesystems, RBAC least privilege, NetworkPolicy default-deny, and image vulnerability scanning with Trivy or Snyk. - Use Case: When reviewing a new service's deployment, use this Skill to check the Dockerfile against the non-root and minimal-image baselines, validate the K8s securityContext and resource limits, and confirm the HPA has CPU requests set. ## Quick Start Ask the AI to review your Dockerfile and Kubernetes deployment manifest against the containerization security checklist and fix any violations.

Frequently Asked Questions about containerization

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write a production-ready Dockerfile for a Python or Node.js app?▼

Use a multi-stage build: install dependencies in a builder stage, copy only the runtime artifacts into a slim final image, and set a non-root USER. Copy dependency manifests before source code so the install layer stays cached across code changes.

How do I configure Kubernetes resource requests and limits?▼

Set requests for scheduling and limits for runtime enforcement on every container. For critical services, set requests equal to limits to get Guaranteed QoS; leave memory headroom above requests to avoid spurious OOMKills during GC spikes.

What securityContext settings should a Kubernetes pod have?▼

Set runAsNonRoot: true with a numeric user at the pod level, and readOnlyRootFilesystem: true, allowPrivilegeEscalation: false, and drop ALL capabilities at the container level. Mount an emptyDir volume for any path that genuinely needs writes.

Why does my HorizontalPodAutoscaler not scale pods?▼

HPA computes utilization as actual usage divided by the CPU request, so it cannot scale when requests.cpu is unset. It also requires the metrics-server addon (or a custom metrics adapter) to be installed in the cluster.

Why does my liveness probe keep restarting healthy pods?▼

A low failureThreshold (1-2) with short periodSeconds (5-10) restarts pods during slow GC pauses or transient database latency. Use failureThreshold: 3 with periodSeconds: 30 as a baseline so the pod tolerates about 90 seconds of unresponsiveness.

Can I commit Kubernetes Secrets to git as base64?▼

No, base64 is encoding, not encryption, so plaintext values are exposed in version control. Use Sealed Secrets, external-secrets-operator syncing from a cloud secret manager, or Vault agent injection instead.

Related Skills

Explore More Software Engineering Skills→
VectorInstituteVectorInstitute

fix-merge-conflicts

Resolve git merge conflicts across dependency, source, and configuration files.

Official
Advanced
sumitakesumitake

kubernetes-specialist

Reviews and troubleshoots Kubernetes manifests, workloads, and cluster configurations for production safety.

Community
Intermediate
kcns008kcns008
5

security

Audit Kubernetes and OpenShift clusters for RBAC, NetworkPolicy, pod security, and compliance gaps.

Community
Advanced
bobmatnycbobmatnyc
68

digitalocean-compute

Manage DigitalOcean compute services including Droplets, Kubernetes, and GPU instances.

Community
Intermediate