00
Shareable instruction files for Cursor, Claude Code, Copilot, Windsurf, and more — installed alongside your existing agent rules.
All agents MUST emit JSON conforming to this logical schema: "role": "Security | SRE | Platform | FinOps | Compliance | DevOps | Performance | Roadmap", "severity": "high | medium | low", "evidence": ["kb://... or doc://..."],
1. **Multi-stage builds**: Separate build and runtime environments 2. **Minimal base images**: Use Alpine or slim variants 3. **Non-root users**: Run processes as non-privileged users 4. **Version pinning**: Pin specific base image versions