Sending build context to Docker daemon 10.24kB

Step 1/5 : FROM alpine:latest

Step 2/5 : RUN apk update && apk add –no-cache nginx

Step 3/5 : RUN adduser -D -u 1001 appuser

Step 4/5 : USER appuser

Step 5/5 : CMD [“nginx”, “-g”, “daemon off;”]

Successfully built 1234567890ab

Successfully tagged fgedu/secure-app:latest

3.2 运行时安全

配置容器运行时安全：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: fgedu-secure-app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: fgedu-secure-app
  template:
    metadata:
      labels:
        app: fgedu-secure-app
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1001
        runAsGroup: 1001
      containers:
      - name: fgedu-secure-app
        image: fgedu/secure-app:latest
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop: ["ALL"]
          readOnlyRootFilesystem: true
        resources:
          limits:
            cpu: "1"
            memory: "512Mi"
          requests:
            cpu: "500m"
            memory: "256Mi"
        ports:
        - containerPort: 80
        

3.3 网络安全

配置网络安全策略：

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: fgedu-app-network-policy
  namespace: default
spec:
  podSelector:
    matchLabels:
      app: fgedu-secure-app
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: fgedu-frontend
    ports:
    - protocol: TCP
      port: 80
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: fgedu-db
    ports:
    - protocol: TCP
      port: 3306
        

Part04-生产案例与实战讲解

4.1 镜像安全扫描

实战案例：集成镜像扫描到CI/CD流程：

from PG视频:www.itpux.com

# .gitlab-ci.yml
stages:
  - build
  - scan
  - deploy

build:
  stage: build
  script:
    - docker build -t fgedu/app:${CI_COMMIT_SHORT_SHA} .
    - docker push fgedu/app:${CI_COMMIT_SHORT_SHA}

scan:
  stage: scan
  script:
    - trivy image fgedu/app:${CI_COMMIT_SHORT_SHA}
    - trivy image --severity HIGH,CRITICAL fgedu/app:${CI_COMMIT_SHORT_SHA} || exit 1

deploy:
  stage: deploy
  script:
    - kubectl set image deployment/fgedu-app app=fgedu/app:${CI_COMMIT_SHORT_SHA}
        

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: tenant-a-isolation
  namespace: tenant-a
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: tenant-a
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          name: tenant-a
    - to:
        ipBlocks:
        - cidr: 10.0.0.0/8
          except:
          - 10.244.0.0/16