Docker 与容器（七）：安全——运行容器时不必交出全部权限

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

FROM python:3.11-slim

WORKDIR /app

# 以 root 安装依赖（系统包安装需要 root）
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# 创建非 root 用户
RUN groupadd -r appuser && useradd -r -g appuser -d /app -s /sbin/nologin appuser

# 复制应用文件并设置所有权
COPY --chown=appuser:appuser . .

# 切换至非 root 用户，后续所有指令及运行时均以此用户执行
USER appuser

EXPOSE 8000
CMD ["gunicorn", "--bind", "0.0.0.0:8000", "app:app"]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

FROM python:3.11-alpine

WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

RUN addgroup -S appuser && adduser -S appuser -G appuser
COPY --chown=appuser:appuser . .
USER appuser

CMD ["gunicorn", "--bind", "0.0.0.0:8000", "app:app"]

1
2
3
4
5

# 以指定 UID:GID 运行
docker run --user 1000:1000 myapp

# 以 "nobody" 用户运行
docker run --user nobody myapp

1
2
3
4
5
6
7

# 检查容器当前运行用户
docker exec my-container id
# 输出：uid=1000(appuser) gid=1000(appuser) groups=1000(appuser)

# 对比默认容器（无 USER 指令）
docker exec default-container id
# 输出：uid=0(root) gid=0(root) groups=0(root)

1
2

# 以只读根文件系统运行
docker run --read-only myapp

1
2
3
4
5

# 根文件系统只读，同时允许 `/tmp` 和 `/var/run` 写入
docker run --read-only \
    --tmpfs /tmp:size=100m \
    --tmpfs /var/run:size=1m \
    myapp

1
2
3
4
5
6
7
8

services:
  api:
    image: myapp
    read_only: true
    tmpfs:
      - /tmp:size=100m
      - /var/run:size=1m
      - /app/cache:size=50m

1
2
3
4

# 查看应用试图写入的位置
docker run --read-only myapp 2>&1 | grep "Read-only file system"
# 输出：OSError: [Errno 30] Read-only file system: '/app/logs/app.log'
# 解决方案：添加 --tmpfs /app/logs:size=50m

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

# 移除全部 capabilities，仅添加必要项
docker run \
    --cap-drop ALL \
    --cap-add NET_BIND_SERVICE \
    myapp

# 需绑定端口 80 的 Web 服务器
docker run \
    --cap-drop ALL \
    --cap-add NET_BIND_SERVICE \
    -p 80:80 \
    nginx

# 大多数应用无需任何 capability
docker run \
    --cap-drop ALL \
    myapp

1
2
3
4
5
6
7

services:
  api:
    image: myapp
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE

1
2
3
4
5

# 查看运行中容器拥有的 capabilities
docker exec my-container cat /proc/1/status | grep Cap

# 解码十六进制 capability 掩码
docker exec my-container capsh --decode=00000000a80425fb

1
2
3
4
5
6
7
8
9

# 绝对禁止：密钥作为构建参数（会保留在镜像历史中）
ARG DB_PASSWORD=supersecret
RUN echo "password=$DB_PASSWORD" >> /app/config

# 绝对禁止：在 Dockerfile 中通过 ENV 设置密钥
ENV API_KEY=sk-12345abcde

# 绝对禁止：将密钥文件 COPY 进镜像
COPY credentials.json /app/credentials.json

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# 构建参数在 history 中可见
docker history myapp
# 显示：ARG DB_PASSWORD=supersecret

# 环境变量在 inspect 中可见
docker inspect myapp --format '{{json .Config.Env}}'
# 显示：["API_KEY=sk-12345abcde"]

# 文件可从镜像中提取
docker create --name extract myapp
docker cp extract:/app/credentials.json .

1

docker run -e DB_PASSWORD=secret -e API_KEY=sk-12345 myapp

1

docker run --env-file .env myapp

1
2
3
4
5
6
7
8
9

# syntax=docker/dockerfile:1

FROM python:3.11-slim

# 构建时挂载密钥 —— 不会保存到任何镜像层
RUN --mount=type=secret,id=pip_extra_index \
    pip install --no-cache-dir \
    --extra-index-url $(cat /run/secrets/pip_extra_index) \
    -r requirements.txt

1
2
3
4

# 使用密钥构建
DOCKER_BUILDKIT=1 docker build \
    --secret id=pip_extra_index,src=./pip_index_url.txt \
    -t myapp .

1
2
3
4
5
6
7
8

# 创建密钥
echo "supersecretpassword" | docker secret create db_password -

# 在服务中使用密钥
docker service create \
    --name api \
    --secret db_password \
    myapp

1
2
3

docker run \
    -v /secure/path/credentials.json:/run/secrets/credentials.json:ro \
    myapp

1
2
3
4
5

# 安装 Trivy
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin

# 扫描镜像
trivy image myapp:latest

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

myapp:latest (debian 12.1)
===========================
Total: 45 (UNKNOWN: 0, LOW: 25, MEDIUM: 12, HIGH: 6, CRITICAL: 2)

+-------------------+------------------+----------+-------------------+-------------------+
|      LIBRARY      |  VULNERABILITY   | SEVERITY | INSTALLED VERSION |   FIXED VERSION   |
+-------------------+------------------+----------+-------------------+-------------------+
| libssl3           | CVE-2023-XXXXX   | CRITICAL | 3.0.9-1           | 3.0.11-1          |
| libcurl4          | CVE-2023-YYYYY   | CRITICAL | 7.88.1-10         | 7.88.1-10+deb12u4 |
| python3.11        | CVE-2023-ZZZZZ   | HIGH     | 3.11.4            | 3.11.5            |
+-------------------+------------------+----------+-------------------+-------------------+

Python (requirements.txt)
==========================
Total: 3 (HIGH: 2, MEDIUM: 1)

+-------------------+------------------+----------+-------------------+-------------------+
|      LIBRARY      |  VULNERABILITY   | SEVERITY | INSTALLED VERSION |   FIXED VERSION   |
+-------------------+------------------+----------+-------------------+-------------------+
| requests          | CVE-2023-AAAAA   | HIGH     | 2.28.0            | 2.31.0            |
| flask             | CVE-2023-BBBBB   | MEDIUM   | 2.2.0             | 2.3.3             |
+-------------------+------------------+----------+-------------------+-------------------+

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# 仅扫描 CRITICAL 和 HIGH 级别漏洞
trivy image --severity CRITICAL,HIGH myapp:latest

# 发现任意漏洞即失败（适用于 CI）
trivy image --exit-code 1 --severity CRITICAL myapp:latest

# 扫描 Dockerfile（构建前检查基础镜像）
trivy config Dockerfile

# 扫描本地文件系统
trivy fs --security-checks vuln,secret ./

1
2
3
4
5
6
7
8

# GitHub Actions 示例
- name: Run Trivy vulnerability scanner
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: 'myapp:${{ github.sha }}'
    format: 'table'
    exit-code: '1'
    severity: 'CRITICAL,HIGH'

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

# 使用 distroless 的多阶段构建
FROM python:3.11-slim AS builder
WORKDIR /app
COPY requirements.txt .
RUN pip install --user --no-cache-dir -r requirements.txt
COPY . .

FROM gcr.io/distroless/python3-debian12
WORKDIR /app
COPY --from=builder /root/.local/lib/python3.11/site-packages /usr/lib/python3.11/site-packages
COPY --from=builder /app .
ENTRYPOINT ["python3", "app.py"]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

FROM golang:1.21 AS builder
WORKDIR /app
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /server .

FROM scratch
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
COPY --from=builder /server /server
EXPOSE 8080
ENTRYPOINT ["/server"]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

# 启用内容信任
export DOCKER_CONTENT_TRUST=1

# 此后 pull/push 均需签名
docker pull nginx:latest
# 仅当镜像已签名时才成功

# 推送已签名镜像（需预先配置签名密钥）
docker push myrepo/myapp:v1.0
# Docker 将提示输入签名口令

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

# 内存限制（超出即被 OOM kill）
docker run --memory 512m myapp

# 内存 + swap 限制
docker run --memory 512m --memory-swap 1g myapp

# CPU 限制（最多占用 0.5 个 CPU 核心）
docker run --cpus 0.5 myapp

# CPU 权重（相对权重，默认 1024）
docker run --cpu-shares 512 myapp

# 组合限制
docker run \
    --memory 512m \
    --memory-swap 512m \
    --cpus 1.0 \
    --pids-limit 100 \
    myapp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

services:
  api:
    image: myapp
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 128M

1
2
3

# 无 --pids-limit 时，fork bomb 可导致宿主机崩溃
# 有该限制时，容器最多运行 100 个进程
docker run --pids-limit 100 myapp

1
2
3
4
5
6
7
8

# 使用默认 seccomp 配置文件（自动启用）
docker run myapp

# 使用自定义 seccomp 配置文件
docker run --security-opt seccomp=/path/to/profile.json myapp

# 禁用 seccomp（生产环境切勿使用）
docker run --security-opt seccomp=unconfined myapp

1
2
3
4
5
6

# 查看 AppArmor 配置文件
docker inspect my-container --format '{{.AppArmorProfile}}'
# 输出：docker-default

# 使用自定义 AppArmor 配置文件
docker run --security-opt apparmor=my-custom-profile myapp

1

docker run --security-opt no-new-privileges:true myapp

1
2
3
4
5

services:
  api:
    image: myapp
    security_opt:
      - no-new-privileges:true

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70

services:
  api:
    build:
      context: ./api
      target: production
    read_only: true
    tmpfs:
      - /tmp:size=100m,mode=1777
      - /var/run:size=1m
    user: "1000:1000"
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 512M
        reservations:
          memory: 128M
    healthcheck:
      test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://localhost:8000/health')\""]
      interval: 30s
      timeout: 5s
      retries: 3
    environment:
      DATABASE_URL: ${DATABASE_URL}
    ports:
      - "8000:8000"
    networks:
      - frontend
      - backend
    restart: unless-stopped
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

  postgres:
    image: postgres:16-alpine
    read_only: true
    tmpfs:
      - /tmp
      - /var/run/postgresql
    user: "999:999"
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    deploy:
      resources:
        limits:
          memory: 1G
    volumes:
      - postgres-data:/var/lib/postgresql/data
    environment:
      POSTGRES_PASSWORD_FILE: /run/secrets/db_password
    networks:
      - backend
    restart: unless-stopped

networks:
  frontend:
  backend:
    internal: true  # 无外部访问 —— 仅该网络内容器可通信

volumes:
  postgres-data: