Container Security Standards for CLAUDE.md

CLAUDE_containerSec.md

Container Security Standards

All container artifacts (Dockerfile, compose files, CI/CD pipeline configs) MUST follow these rules. Violations are treated as bugs.

Base Image

• Use distroless, alpine, or -slim variants only
• Pin versions with digest: FROM node:22-alpine@sha256:abc...
• Multi-stage builds mandatory — no build toolchains in final image

Runtime Security

• USER nonroot — never run as root
• read_only: true in compose
• security_opt: [no-new-privileges:true]
• cap_drop: [ALL], add back only what's explicitly needed
• Never mount Docker socket unless I explicitly ask and justify it

Secrets

• Never use ARG/ENV for secrets at build time
• Use docker compose secrets, mounted files, or runtime env injection
• .dockerignore must exclude: .env*, .git, node_modules, *.key, *.pem

Health & Observability

• Every service gets a HEALTHCHECK (Dockerfile) or healthcheck: (compose)
• Include interval, timeout, retries, start_period
• Prefer curl-free checks: use built-in runtime checks or wget in alpine

Image Hygiene

• Combine RUN layers, clean caches in same layer
• No orphan ports — only expose what's needed
• Tag images with git SHA or semver, never :latest in production configs

Exceptions

If any rule cannot be followed, add an inline comment: # SECURITY-EXCEPTION: <reason>