# 构建安全的Nginx镜像
$ cat > Dockerfile << 'EOF'
FROM alpine:3.16

# 更新系统包
RUN apk update && apk add --no-cache nginx && rm -rf /var/cache/apk/*

# 创建非root用户
RUN adduser -D -u 1000 nginx

# 设置文件权限
RUN chown -R nginx:nginx /etc/nginx /var/log/nginx /var/lib/nginx

# 配置Nginx
RUN echo 'events {
    worker_connections 1024;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    
    access_log /var/log/nginx/access.log main;
    error_log /var/log/nginx/error.log warn;
    
    sendfile on;
    keepalive_timeout 65;
    
    server {
        listen 80;
        server_name localhost;
        
        location / {
            root /usr/share/nginx/html;
            index index.html index.htm;
        }
        
        error_page 500 502 503 504 /50x.html;
        location = /50x.html {
            root /usr/share/nginx/html;
        }
    }
}' > /etc/nginx/nginx.conf

# 切换到非root用户
USER nginx

# 暴露端口
EXPOSE 80

# 启动Nginx
CMD ["nginx", "-g", "daemon off;"]
EOF

# 构建镜像
$ docker build -t secure-nginx:1.0 .

# 运行容器
$ docker run --name secure-nginx \
    --user 1000:1000 \
    --read-only \
    --cap-drop ALL \
    --memory 128m \
    --cpus 0.5 \
    -p 80:80 \
    -d \
    secure-nginx:1.0

1234567890ab

风哥提示：使用非root用户运行容器，限制容器权限，可以提高容器的安全性。

4.2 镜像安全管理实战

案例：扫描镜像漏洞

# 扫描Nginx镜像漏洞
$ docker scan nginx:1.24

✗ Low severity vulnerability found in openssl/libssl1.1
  Description: Incorrect Calculation
  Info: https://snyk.io/vuln/SNYK-ALPINE316-OPENSSL-32383
  Introduced through: openssl/libssl1.1@1.1.1q-r0
  From: base-image
  Fixed in: 1.1.1q-r1
  
✗ Medium severity vulnerability found in openssl/libssl1.1
  Description: Use After Free
  Info: https://snyk.io/vuln/SNYK-ALPINE316-OPENSSL-32384
  Introduced through: openssl/libssl1.1@1.1.1q-r0
  From: base-image
  Fixed in: 1.1.1q-r1
  
✓ Tested 183 dependencies for known vulnerabilities, found 2 issues.

# 构建修复漏洞的镜像
$ cat > Dockerfile << 'EOF'
FROM alpine:3.16
RUN apk update && apk add --no-cache nginx openssl=1.1.1q-r1 && rm -rf /var/cache/apk/*
RUN adduser -D -u 1000 nginx
USER nginx
EXPOSE 80
CMD ["nginx", "-g", "daemon off;"]
EOF

$ docker build -t secure-nginx:1.1 .

# 创建前端网络
$ docker network create --driver bridge frontend-network

# 创建后端网络
$ docker network create --driver bridge backend-network

# 创建数据库网络
$ docker network create --driver bridge db-network

# 运行前端容器
$ docker run --name frontend \
    --network frontend-network \
    -p 80:80 \
    -d \
    nginx:1.24

# 运行后端容器
$ docker run --name backend \
    --network backend-network \
    -p 3000:3000 \
    -d \
    node:18

# 运行数据库容器
$ docker run --name db \
    --network db-network \
    -e MYSQL_ROOT_PASSWORD=SecurePassword123! \
    -d \
    mysql:8.0

# 连接后端容器到前端网络
$ docker network connect frontend-network backend

# 连接后端容器到数据库网络
$ docker network connect db-network backend

# 测试网络隔离
$ docker exec -it frontend ping db
$ docker exec -it db ping frontend

ping: db: Name or service not known
ping: frontend: Name or service not known