# 创建Dockerfile
$ cat > Dockerfile << 'EOF'
FROM alpine:latest

RUN apk update && apk upgrade && apk add --no-cache \
    nginx \
    && rm -rf /var/cache/apk/* \
    && mkdir -p /run/nginx \
    && addgroup -S nginxgroup && adduser -S nginxuser -G nginxgroup \
    && chown -R nginxuser:nginxgroup /var/lib/nginx /run/nginx

COPY nginx.conf /etc/nginx/nginx.conf
COPY index.html /usr/share/nginx/html/

USER nginxuser

EXPOSE 8080

CMD ["nginx", "-g", "daemon off;"]
EOF

# 创建nginx.conf
$ cat > nginx.conf << 'EOF'
events {
    worker_connections 1024;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    server {
        listen 8080;
        server_name localhost;

        root /usr/share/nginx/html;
        index index.html;

        location / {
            try_files $uri $uri/ =404;
        }
    }
}
EOF

# 创建index.html
$ cat > index.html << 'EOF'

    
Welcome to Secure Nginx Container
    
This is a hardened Nginx container.

EOF

# 构建镜像
$ docker build -t fgedu/nginx-secure:latest .

[+] Building 10.0s (10/10) FINISHED
 => [internal] load build definition from Dockerfile
 => => transferring dockerfile: 385B
 => [internal] load .dockerignore
 => => transferring context: 2B
 => [internal] load metadata for docker.io/library/alpine:latest
 => [1/6] FROM docker.io/library/alpine:latest
 => [2/6] RUN apk update && apk upgrade && apk add --no-cache nginx && rm -rf /var/cache/apk/* && mkdir -p /run/nginx && addgroup -S nginxgroup && adduser -S nginxuser -G nginxgroup && chown -R nginxuser:nginxgroup /var/lib/nginx /run/nginx
 => [3/6] COPY nginx.conf /etc/nginx/nginx.conf
 => [4/6] COPY index.html /usr/share/nginx/html/
 => [5/6] USER nginxuser
 => [6/6] CMD ["nginx", "-g", "daemon off;"]
 => exporting to image
 => => exporting layers
 => => writing image sha256:1234567890abcdef...
 => => naming to docker.io/fgedu/nginx-secure:latest

4.2 容器安全加固实战

案例：运行安全加固的容器

# 运行安全加固的Nginx容器
$ docker run \
    --name nginx-secure \
    --security-opt no-new-privileges \
    --cap-drop ALL \
    --read-only \
    -v /tmp:/tmp:rw \
    -v /var/log/nginx:/var/log/nginx:rw \
    -p 8080:8080 \
    fgedu/nginx-secure:latest

2024/01/01 10:00:00 [notice] 1#1: using the "epoll" event method
2024/01/01 10:00:00 [notice] 1#1: nginx/1.24.0
2024/01/01 10:00:00 [notice] 1#1: built by gcc 12.2.1 20220924 (Alpine 12.2.1_git20220924-r4)
2024/01/01 10:00:00 [notice] 1#1: OS: Linux 5.15.0-100-generic
2024/01/01 10:00:00 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1048576:1048576
2024/01/01 10:00:00 [notice] 1#1: start worker processes
2024/01/01 10:00:00 [notice] 1#1: start worker process 7

# 创建MySQL配置文件
$ cat > my.cnf << 'EOF'
[mysqld]
bind-address = 127.0.0.1
skip-networking = 0
skip-name-resolve
character-set-server = utf8mb4
collation-server = utf8mb4_unicode_ci

# 安全设置
secure-file-priv = /tmp
sql-mode = "STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_ENGINE_SUBSTITUTION"

# 性能设置
max_connections = 100
innodb_buffer_pool_size = 256M
EOF

# 运行MySQL容器
$ docker run \
    --name mysql-secure \
    --security-opt no-new-privileges \
    --cap-drop ALL \
    --read-only \
    -v /tmp:/tmp:rw \
    -v /Docker/fgdata/mysql:/var/lib/mysql:rw \
    -v $(pwd)/my.cnf:/etc/mysql/my.cnf:ro \
    -e MYSQL_ROOT_PASSWORD=SecurePassword123! \
    -e MYSQL_DATABASE=fgedudb \
    -e MYSQL_USER=fgedu \
    -e MYSQL_PASSWORD=SecurePassword123! \
    -p 3306:3306 \
    mysql:8.0

2024-01-01T10:00:00.000Z 0 [System] [MY-010116] [Server] /usr/sbin/mysqld (mysqld 8.0.34) starting as process 1
2024-01-01T10:00:00.000Z 0 [Warning] [MY-010091] [Server] Can't create test file /var/lib/mysql/562432863585.lower-test
2024-01-01T10:00:00.000Z 0 [System] [MY-010158] [Server] Setting lower_case_table_names=0 because file system for /var/lib/mysql/ is case sensitive
2024-01-01T10:00:00.000Z 0 [System] [MY-013169] [Server] /usr/sbin/mysqld: ready for connections.
Version: '8.0.34'  socket: '/var/run/mysqld/mysqld.sock'  port: 3306  MySQL Community Server - GPL