容器安全最佳实践

# ❌ 不安全：包含 shell、包管理器、调试工具
FROM ubuntu:22.04
RUN apt-get update && apt-get install -y python3 curl
COPY app.py /app/
CMD ["python3", "/app/app.py"]

# ✅ 安全：Distroless，无 shell、无包管理器
FROM python:3.11-slim AS builder
WORKDIR /app
COPY requirements.txt .
RUN pip install --user --no-cache-dir -r requirements.txt

FROM gcr.io/distroless/python3-debian12
WORKDIR /app
COPY --from=builder /root/.local /home/nonroot/.local
COPY app.py .
USER nonroot:nonroot
ENV PATH=/home/nonroot/.local/bin:$PATH
CMD ["app.py"]

# 编译阶段（包含编译工具）
FROM golang:1.21-alpine AS build
WORKDIR /src
COPY . .
RUN CGO_ENABLED=0 go build -o /bin/app ./cmd/app

# 最终阶段（仅二进制）
FROM scratch
COPY --from=build /bin/app /app
COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
ENTRYPOINT ["/app"]

# Trivy 扫描
trivy image myapp:latest

# 只关注严重/高危
trivy image --severity CRITICAL,HIGH myapp:latest

# 镜像签名（Cosign）
cosign generate-key-pair

cosign sign --key cosign.key myregistry/myapp:latest

cosign verify --key cosign.pub myregistry/myapp:latest

# ✅ 使用官方镜像，指定具体版本
FROM python:3.11.6-slim-bookworm

# ✅ 创建非 root 用户
RUN groupadd -r appgroup && useradd -r -g appgroup appuser

# ✅ 设置工作目录
WORKDIR /app

# ✅ 先复制依赖，利用缓存层
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# ✅ 再复制应用代码
COPY --chown=appuser:appgroup . .

# ✅ 只暴露需要的端口
EXPOSE 8080

# ✅ 切换到非 root 用户
USER appuser:appgroup

# ✅ 使用 HEALTHCHECK
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s \
  CMD curl -f http://localhost:8080/health || exit 1

# ✅ 明确 ENTRYPOINT/CMD
ENTRYPOINT ["python"]
CMD ["app.py"]

# 默认 Docker 容器会 drop 大部分 capabilities
# 只保留必要的：

# 查看容器 capabilities
docker run --rm alpine:latest capsh --print

# 运行容器时移除所有 capabilities，只添加需要的
docker run --cap-drop=ALL --cap-add=NET_BIND_SERVICE nginx

# Kubernetes
capabilities:
  drop:
    - ALL
  add:
    - NET_BIND_SERVICE

// 自定义 seccomp 配置（限制系统调用）
{
  "defaultAction": "SCMP_ACT_ERRNO",
  "syscalls": [
    {
      "names": ["accept", "bind", "connect", "listen", "socket"],
      "action": "SCMP_ACT_ALLOW"
    }
  ]
}

# Docker 使用自定义 seccomp
docker run --security-opt seccomp=custom-seccomp.json myapp

# Kubernetes
securityContext:
  seccompProfile:
    type: Localhost
    localhostProfile: profiles/custom.json

# 查看当前 AppArmor 状态
sudo aa-status

# Docker 使用 AppArmor 策略
docker run --security-opt apparmor=docker-default nginx

# Kubernetes
metadata:
  annotations:
    container.apparmor.security.beta.kubernetes.io/nginx: runtime/default

# Docker 使用 SELinux
docker run --security-opt label=type:container_t nginx

apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted
---
apiVersion: v1
kind: Pod
metadata:
  name: secure-app
  namespace: production
spec:
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
    fsGroup: 1000
  containers:
    - name: app
      image: myapp:1.0
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop:
            - ALL
        runAsUser: 1000
        runAsGroup: 1000
      resources:
        limits:
          memory: "256Mi"
          cpu: "500m"
      volumeMounts:
        - name: tmp
          mountPath: /tmp
  volumes:
    - name: tmp
      emptyDir: {}

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-non-root
spec:
  validationFailureAction: enforce
  rules:
    - name: check-runasnonroot
      match:
        resources:
          kinds:
            - Pod
      validate:
        message: "Pod 必须设置 runAsNonRoot: true"
        pattern:
          spec:
            securityContext:
              runAsNonRoot: true

# falco-rule.yaml
- rule: Terminal Shell in Container
  desc: Detect shell spawned in container
  condition: spawned_process and container and shell_procs
  output: >
    Shell spawned in container
    (user=%user.name container=%container.name shell=%proc.name)
  priority: WARNING

- rule: Unauthorized K8s API Access
  desc: Detect access to K8s API from unexpected sources
  condition: >
    k8s_audit and k8s_audit_object_resource=pods
    and not (ka.auth.decision=allow and authorized_user)
  output: Unauthorized K8s API access
  priority: CRITICAL

# 运行 Falco
docker run -d --name falco \
  --privileged \
  -v /var/run/docker.sock:/host/var/run/docker.sock \
  -v /dev:/host/dev \
  -v /proc:/host/proc:ro \
  -v /boot:/host/boot:ro \
  -v /lib/modules:/host/lib/modules:ro \
  -v /usr:/host/usr:ro \
  falcosecurity/falco:latest