Docker 生产安全指南：镜像扫描、非 root 运行、Secret 管理与 Registry

# 安装 Trivy
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh

# 扫描本地镜像
trivy image my-app:latest

# 扫描特定严重级别并输出为 JSON
trivy image --severity HIGH,CRITICAL \
            --format json \
            --output trivy-report.json \
            my-app:latest

# 扫描公开镜像仓库中的镜像
trivy image alpine:3.18

# 安装 Snyk
npm install -g snyk
snyk auth

# 容器镜像扫描
snyk container test my-app:latest --severity-threshold=high

# 监控镜像持续跟踪新漏洞
snyk container monitor my-app:latest --project-name=production-api

# 快速查看镜像安全概要
docker scout quickview my-app:latest

# 查看 CVE 详情（含 CVSS 分数）
docker scout cves --only-packages openssh,openssl my-app:latest

# 比较两个镜像版本之间的漏洞变化
docker scout compare --to my-app:v1.0 my-app:v1.1

# .github/workflows/image-scan.yml
name: Image Security Scan
on: [push]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Build image
        run: docker build -t my-app:${{ github.sha }} .
      - name: Run Trivy scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'my-app:${{ github.sha }}'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'
          ignore-unfixed: true

# 正确的做法：在 Dockerfile 中创建非 root 用户
FROM node:20-alpine

# 创建用户组和用户
RUN addgroup -S appgroup && adduser -S appuser -G appgroup

# 设置工作目录并赋予非 root 用户所有权
WORKDIR /app
COPY --chown=appuser:appgroup package*.json ./
RUN npm ci
COPY --chown=appuser:appgroup . .

# 切换到非 root 用户
USER appuser
EXPOSE 3000
CMD ["node", "server.js"]

# 验证容器内进程不以 root 运行
docker run --rm -it my-app id
# 输出应为：uid=1000(appuser) gid=1000(appgroup) groups=1000(appgroup)

# 启动只读容器，同时挂载临时可写目录用于日志/缓存
docker run \
  --read-only \
  -v /tmp:/tmp \
  -v /app/logs:/app/logs \
  -e LOG_PATH=/app/logs \
  my-app:latest

# CPU、内存、swap、PID 限制
docker run \
  --memory=512m \
  --memory-swap=512m \
  --cpus=1.0 \
  --pids-limit=100 \
  my-app:latest

# ❌ 极度危险：容器获得宿主机 root 权限和设备访问
docker run --privileged my-app

# ✅ 正确的做法：仅授予必要的 capabilities
docker run \
  --cap-drop=ALL \
  --cap-add=NET_BIND_SERVICE \
  --cap-add=SETUID \
  my-app

# syntax=docker/dockerfile:1
FROM node:20-alpine
WORKDIR /app
COPY package*.json ./
RUN --mount=type=secret,id=npmrc,target=/root/.npmrc \
    npm ci --prefer-offline
COPY . .
RUN npm run build

# 构建时传入 secret，不会写入任何镜像层
DOCKER_BUILDKIT=1 docker build \
  --secret id=npmrc,src=$HOME/.npmrc \
  --secret id=aws,src=$HOME/.aws/credentials \
  -t my-app:v1.0 .

# 构建后验证 secret 不在镜像中
docker run --rm my-app:v1.0 cat /root/.npmrc
# 应输出 cat: can't open '/root/.npmrc': No such file or directory

# Docker Swarm Secret 示例
echo "my-super-secret-password" | docker secret create db_password -

# 创建服务并绑定 Secret
docker service create \
  --name my-api \
  --secret db_password \
  --secret source=ca_bundle,target=/run/secrets/ca.crt \
  my-app:latest

# 在容器内部，secret 以文件形式挂载到 /run/secrets/
docker exec <container_id> cat /run/secrets/db_password

# 下载并配置 Harbor
curl -L https://github.com/goharbor/harbor/releases/download/v2.10.0/harbor-offline-installer-v2.10.0.tgz \
  -o harbor-offline-installer.tgz
tar xvf harbor-offline-installer.tgz
cd harbor

cp harbor.yml.tmpl harbor.yml
# 编辑 harbor.yml 配置主机名和 HTTPS 证书
# hostname: harbor.example.com
# https.certificate: /your/cert/path

# 安装并启动
sudo ./install.sh --with-trivy

# 查看服务状态
docker-compose -f docker-compose.yml ps

# 登录到 Harbor Registry
docker login harbor.example.com

# 标记镜像
docker tag my-app:v1.0 harbor.example.com/project-a/my-app:v1.0

# 推送镜像
docker push harbor.example.com/project-a/my-app:v1.0

# 在 Harbor UI 上查看镜像及其扫描结果

// my-seccomp.json — 自定义 seccomp 配置文件
{
  "defaultAction": "SCMP_ACT_ERRNO",
  "syscalls": [
    {
      "names": ["read", "write", "open", "close", "exit", "exit_group"],
      "action": "SCMP_ACT_ALLOW"
    },
    {
      "names": ["bind", "connect", "accept", "listen", "socket"],
      "action": "SCMP_ACT_ALLOW",
      "comment": "允许网络相关系统调用"
    },
    {
      "names": ["execve", "execveat"],
      "action": "SCMP_ACT_ERRNO",
      "comment": "禁止执行新程序，防止 shell 逃逸"
    }
  ]
}

# 启动容器时加载自定义 seccomp 配置
docker run \
  --security-opt seccomp=/path/to/my-seccomp.json \
  my-app:latest

# 查看当前容器的 AppArmor 状态
docker inspect <container_id> | grep -i apparmor

# 加载自定义 AppArmor 策略
sudo apparmor_parser -r -W /etc/apparmor.d/containers/docker-myapp

# 启动容器绑定自定义 AppArmor 策略
docker run \
  --security-opt apparmor=docker-myapp \
  my-app:latest

# /etc/apparmor.d/containers/docker-myapp 示例
profile docker-myapp flags=(attach_disconnected,mediate_deleted) {
  #include <tunables/global>
  capability chown,
  capability setuid,
  deny /proc/sys/** w,
  deny /etc/shadow r,
  /app/** rw,
  /tmp/ rw,
}

# 检查 SELinux 状态
getenforce
# 输出 Expected: Enforcing

# 启动容器时启用 SELinux 标记
docker run \
  -v /host/data:/data:Z \
  --security-opt label=disable:false \
  my-app:latest

# 完整示例：Web 服务容器仅需网络绑定能力
docker run \
  --cap-drop=ALL \
  --cap-add=CHOWN \
  --cap-add=SETGID \
  --cap-add=SETUID \
  --cap-add=NET_BIND_SERVICE \
  --security-opt no-new-privileges:true \
  -p 8080:8080 \
  my-nginx

# 安装 rootless Docker 工具包
curl -fsSL https://get.docker.com/rootless | sh

# 验证安装
dockerd-rootless-setuptool.sh check

# 启动 rootless Docker 守护进程
export PATH=$HOME/bin:$PATH
export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/docker.sock
dockerd-rootless.sh &

# /etc/subuid 配置
echo "app:100000:65536" | sudo tee -a /etc/subuid

# /etc/subgid 配置
echo "app:100000:65536" | sudo tee -a /etc/subgid

# 安装 Cosign
wget https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64
chmod +x cosign-linux-amd64
sudo mv cosign-linux-amd64 /usr/local/bin/cosign

# 使用 OIDC（如 GitHub Actions）进行密钥less签名
cosign sign --yes harbor.example.com/my-app:v1.0

# 验证签名（无需手动分发公钥）
cosign verify \
  --certificate-identity=your-ci@example.com \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  harbor.example.com/my-app:v1.0

# 使用 Notary v2 (notation) 签名镜像
notation sign harbor.example.com/my-app:v1.0

# 验证镜像签名
notation verify harbor.example.com/my-app:v1.0

# 使用 Syft 生成 SBOM
syft my-app:latest -o spdx-json=sbom.spdx.json

# 使用 Trivy 生成 SBOM
trivy image --format cyclonedx --output sbom.json my-app:latest

# 将 SBOM 作为制品伴随镜像推送
cosign attest \
  --predicate sbom.spdx.json \
  --type spdxjson \
  harbor.example.com/my-app:v1.0

# 创建自定义 bridge 网络
docker network create --driver bridge isolated-net

# 启动服务时加入自定义网络
docker run -d --name frontend --network isolated-net frontend:latest
docker run -d --name backend --network isolated-net backend:latest

# 限制边界网络接入，只有前端可暴露端口到外网
docker run -d --name db --network isolated-net \
  --network-alias postgres \
  postgres:15

# 创建禁用 ICC 的桥接网络
docker network create \
  --driver bridge \
  --opt com.docker.network.bridge.enable_icc=false \
  high-secure-net

# 阻止容器访问特定 IP（例如元数据服务）
iptables -I DOCKER-USER -d 169.254.169.254 -j DROP

# 仅允许容器访问外部 HTTPS 端口
iptables -I DOCKER-USER -p tcp ! --dport 443 -j DROP

# 持久化规则
apt-get install -y iptables-persistent
netfilter-persistent save

# 使用 Helm 安装 Falco
helm repo add falcosecurity https://falcosecurity.github.io/charts
helm repo update
helm install falco falcosecurity/falco \
  --set driver.kind=modern_ebpf \
  --set tty=true

# 查看内核触发的 Falco 告警
kubectl logs -l app.kubernetes.io/name=falco | grep Warning

# /etc/falco/rules.d/custom.yaml
- rule: Reverse Shell Detected
  desc: Detect spawn of a shell with an established network connection
  condition: >
    spawned_process and
    shell_procs and
    (inbound_outbound or
     fd.name in ("127.0.0.1", "0.0.0.0"))
  output: >
    Reverse shell connection detected
    user=%user.name command=%proc.cmdline parent=%proc.pname
    connection=%fd.name
  priority: CRITICAL

# 安装 Sysdig
sudo apt-get install -y sysdig

# 抓取特定容器的全部系统调用（用于事后分析）
sudo sysdig -pc -c echo_fds \
  container.name=my-app > /tmp/container-forensics.scap &

# 读取抓包文件
sudo sysdig -r /tmp/container-forensics.scap \
  "proc.aname contains curl and evt.type=connect"

# 在 daemon.json 中启用审计日志
sudo tee /etc/docker/daemon.json << 'EOF'
{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  },
  "labels": ["environment", "service"],
  "live-restore": true
}
EOF

sudo systemctl restart docker

# 查看审计日志
cat /var/log/audit/audit.log | grep docker

# Distroless 示例：静态编译 Go 应用
FROM golang:1.22 AS builder
WORKDIR /app
COPY . .
RUN CGO_ENABLED=0 go build -o main .

# 运行时镜像仅包含 scratch + CA certs
gcr.io/distroless/static-debian12:nonroot
COPY --from=builder /app/main /main
USER nonroot:nonroot
ENTRYPOINT ["/main"]

# Chiseled 示例：最小化 Ubuntu 基础镜像
FROM ubuntu:22.04 AS builder
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates

FROM ubuntu:22.04
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
COPY my-app /usr/local/bin/my-app
ENTRYPOINT ["my-app"]

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "docker"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 10
    ignore:
      - dependency-name: "node"
        update-types: ["version-update:semver-major"]

  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "daily"
    commit-message:
      prefix: "security"

# 使用 Trivy 的漏洞数据库评估可利用性
trivy image --vuln-type os \
            --severity HIGH,CRITICAL \
            --ignore-unfixed \
            my-app:latest