# Orchestrator Container Spawn

Spawning and hardening scan containers from the recon orchestrator: the security flags...

- Repository: https://github.com/samugit83/redamon (3261 stars)
- Category: Security
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add samugit83/redamon --skill orchestrator-container-spawn -g -a claude-code -y`
Codex: `npx skills add samugit83/redamon --skill orchestrator-container-spawn -g -a codex -y`
Cursor: `npx skills add samugit83/redamon --skill orchestrator-container-spawn -g -a cursor -y`
Gemini CLI: `npx skills add samugit83/redamon --skill orchestrator-container-spawn -g -a gemini-cli -y`

## Description

Spawning and hardening scan containers from the recon orchestrator: the security flags that look correct and break the container, and the sibling bind-mount path handling. cap_drop and no-new-privileges were each reverted after breaking real scans. Trigger: editing recon_orchestrator/container_manager.py; changing how a scan container is spawned or hardened; touching _scanner_hardening, sibling_host_path, cap_drop, security_opt, or a bind mount for a spawned container.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

## When to Use

- Changing how the orchestrator launches or secures a scan container
  ([recon_orchestrator/container_manager.py](../../recon_orchestrator/container_manager.py)).

For the no-`env_file` knob rule, see the recon_orchestrator
[AGENTS.md](../../recon_orchestrator/AGENTS.md) CRITICAL RULES (not repeated here).

---

## Critical Rules

The rest: https://github.com/samugit83/redamon/blob/HEAD/skills/orchestrator-container-spawn/SKILL.md