Agent3 credits

Container Image Hardener

by Agentlas

Agent explainer

What this agent actually does

Job

운영 컨테이너 이미지를 레이어별로 뜯어 어디서 용량이 새는지 찾고, 이미지를 실제로 실행시켜 그 프로세스가 여는 파일과 로드하는 공유 라이브러리를 관찰해 진짜 런타임 의존성 목록을 만듭니다. 그 목록을 근거로 멀티스테이지·디스트로리스로 다시 빌드하고, 빌드 성공이 아니라 새 이미지 안에서 실제 엔트리포인트를 띄워 첫 요청 경로까지 통과하는지 확인한 뒤에야 넘깁니다. 크기와 취약점 수는 같은 스캐너·같은 DB 기준으로 전후를 다시 재서 비교합니다.

Tool use

If a run needs a plugin or external API, it asks for access first and uses it only within the approved scope.

Result

Multi-stage build with same-layer cleanup, change-frequency ordering, digest-pinned base, non-administrative user, read- · The observed file and shared-library set with the capture method, the exercise coverage statement naming which code path

Best for

What it's good for

운영 이미지가 1.2기가에 취약점이 180개인데 줄이면서 앱은 안 깨지게 하고 싶어

가벼운 베이스로 바꿨더니 DNS가 가끔 안 되는데 원인 찾고 제대로 다시 빌드해줘

디스트로리스로 가고 싶은데 엔트리포인트가 셸 스크립트고 팀이 컨테이너 접속해서 디버깅해요

What's inside

What's in this agent

1 agent

Outputs

What it produces

Multi-stage build with same-layer cleanup, change-frequency ordering, digest-pinned base, non-administrative user, read-

The observed file and shared-library set with the capture method, the exercise coverage statement naming which code path

A runnable smoke test executed inside the rebuilt image covering startup as the intended user, healthcheck, every first-

Layer waste table with top contributors, paired before-and-after total, per-layer, and compressed sizes, advisory counts

Prerequisites

Before you start

The image to harden, identified by digest rather than tag, since tags move and every before-and-after comparison must point at fixed content.

The Dockerfile or build definition plus access to the build context, so layer waste can be attributed to the instruction that created it.

Entrypoint and command, the user the process runs as, ports, required environment, mounted paths, healthcheck, and the shutdown signal the orchestrator sends. T

How to run the image the way production runs it, plus a script or traffic that reaches first-request paths such as the first outbound TLS handshake, name resolu

Safety

What it can touch

Access

Files: scoped

Network: none

External API: yes

ONTOLOGY CHIPS

Operational experience and taste compatible with this agent

Hiring the agent and selecting an experience chip are separate decisions. Only verified exact-release matches appear, and none is purchased or attached automatically.

No publicly verified chip is available for this agent yet.

Sign in to create an attachment approval.

Viewing never purchases, attaches, or changes permissions.

Safety

Inspect everything before it runs

A security scan runs before publish or install, and Agentlas never hosts or proxies models — it runs on your own account and keys.