helix.mcp: Skill for Claude Code

SKILL: Container Image Hardening

Context: Pre-publish hardening steps for a new Dockerfile + GitHub Actions workflow. Apply before the first real image publish so the baseline is clean.

---

Recipe 1 — Non-root user

Why

Running as root with a world-writable home (chmod 0777) allows any co-tenant process to replace files in the home directory (e.g., SQLite cache). A dedicated non-root user restricts writes to that UID.

Pattern

# In the runtime stage, before WORKDIR/COPY:

# -r = system user (no password aging, no login shell — appropriate for service accounts)
# -u 1000 = stable UID; conventional first non-system user, predictable for bind-mount semantics
# -d = home dir path
# -m = create home dir owned by hlx:hlx (no extra chown/chmod needed)
RUN useradd -r -u 1000 -d /home/hlx -m hlx

ENV HOME=/home/hlx

WORKDIR /app
COPY --from=build /publish .

# Any RUN steps that write to system paths (e.g., /usr/local/bin) must come BEFORE USER
RUN ln -s /app/HelixTool /usr/local/bin/hlx

# Switch to non-root before runtime.
# docker run --rm -i (stdio MCP via gh-aw) is unaffected — stdin/stdout are
# file descriptors and do not require host-side UID matching.
USER hlx

ENTRYPOINT ["hlx"]

Key rules

1. RUN useradd must come before USER hlx (obviously).
2. Any RUN that writes to system paths (symlinks into /usr/local/bin, apt-get, etc.) must also come before USER hlx.
3. useradd -m creates the home directory with correct ownership — do not add chmod 0777 afterward.
4. For stdio MCP containers: docker run --rm -i passes stdin via file descriptor, not via TTY — non-root UID does not interfere.

---

Recipe 2 — Digest-pin base images

Why

Mutable tags like :10.0 can be updated at any time. A rebuild days later may pull a different image, producing a non-reproducible build. Digest pins lock the exact image layer set.

How to get digests (no Docker daemon needed)

curl -s -I \
  -H "Accept: application/vnd.docker.distribution.manifest.list.v2+json" \
  "https://mcr.microsoft.com/v2/dotnet/sdk/manifests/10.0" \
  | grep -i "docker-content-digest"

curl -s -I \
  -H "Accept: application/vnd.docker.distribution.manifest.list.v2+json" \
  "https://mcr.microsoft.com/v2/dotnet/runtime/manifests/10.0" \
  | grep -i "docker-content-digest"