The logic follows the actual flow of code: AI agent → dependencies → container build → attestations → vulnerability gate.
The technical breakdown #
If you're looking for a practical tutorial on how to actually lock this down, here is the workflow.
- Sandbox your AI agents.
Running an LLM agent with full shell access to your local machine is a gamble. Whether it's Claude Code or a custom agent, they can be tricked into exfiltrating .env
files or running rogue scripts. Use a microVM like Docker Sandboxes (sbx
).
sbx policy init deny-all
This ensures a deny-by-default network policy so the agent can't just phone home your secrets.2. Freeze dependencies.
Stop blindly pulling the latest npm packages the second they drop. A five-day cooldown is usually enough to catch "left-pad" style disasters or malicious injections.
Action: Usenpm ci --ignore-scripts
to kill those dangerous lifecycle scripts.Config: Setmin-release-age=5
in your npm config.
Hardened multi-stage builds.
Stop using bloated base images. Switch to hardened versions (like
dhi.io/node:26
) and always separate your build environment from your runtime environment. If your production image doesn't need npm
or gcc
, it shouldn't have them.4. SBOM and Provenance.
You can't secure what you can't see. You need a Software Bill of Materials (SBOM) and maximum-level provenance for every image. Enable BuildKit attestations in your CI/CD pipeline so every layer is tracked.
- The vulnerability gate.
Scanning is useless if it's just a "warning" that everyone ignores. Use Trivy to scan the SBOM attached to the specific image digest. If there is a "Critical" CVE that has a fix available, the build should fail. No exceptions.
Automating this with AI agents #
The interesting part is that you can actually make your AI agent implement these security controls for you. There is a portable SIP skill available that handles the heavy lifting.
To get it running in your agentic client:
Install the SIP skill: https://github.com/ContainerSecurity-dev/sip-skill
Once the skill is installed, you can just point your agent at a repo and run:
$sip SIP it up! Implement controls ii through v.
This takes the theoretical "best practices" and turns them into actual PRs. For anyone wanting to see a real-world deployment of this, there's a sample repo that shows this entire flow integrated into GitHub Actions:
https://github.com/ContainerSecurity-dev/sip
It's a straightforward AI workflow: isolate the tool, freeze the inputs, harden the build, and gate the output.
Next Stacked PRs will save your reviewers from hating your 3 →