https://plumephp.com/tags/scanning/Recent content in Scanning on PlumePHPHugozh-CNSat, 22 Nov 2025 08:00:00 +0800https://plumephp.com/docker-production-security/Sat, 22 Nov 2025 08:00:00 +0800https://plumephp.com/docker-production-security/<p><strong>Docker 容器不是天然安全的</strong>：默认以 root 运行、镜像可能包含漏洞、构建时 Secret 泄露。本文覆盖 Docker 生产环境的安全加固全套方案。</p> <hr> <h2 id="一镜像安全扫描">一、镜像安全扫描</h2> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># Trivy（最受欢迎的开源扫描器）</span> </span></span><span class="line"><span class="cl">trivy image my-app </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># Snyk（商业， generous free tier）</span> </span></span><span class="line"><span class="cl">snyk container <span class="nb">test</span> my-app </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># Docker Scout（Docker 官方）</span> </span></span><span class="line"><span class="cl">docker scout quickview my-app </span></span><span class="line"><span class="cl">docker scout cves my-app </span></span></code></pre></div><p>扫描内容：OS 包漏洞（CVE）、npm/pip 依赖漏洞、不安全的配置（如 root 运行）。</p>