# 安装Trivy镜像扫描工具
$ sudo dnf install -y trivy

# 扫描镜像
$ trivy image docker.io/library/httpd

# 输出日志（部分）
2026-04-10T10:00:00Z INFO Need to update DB
2026-04-10T10:00:00Z INFO Downloading DB…
2026-04-10T10:00:00Z INFO Scanning image: docker.io/library/httpd
2026-04-10T10:00:00Z INFO Detected OS: debian
2026-04-10T10:00:00Z INFO Detected OS version: 11.0
2026-04-10T10:00:00Z INFO Detecting vulnerabilities…
2026-04-10T10:00:00Z INFO Number of language-specific files: 0

Total: 10 (HIGH: 2, MEDIUM: 5, LOW: 3)

┌─────────────────┬────────────────┬──────────┬───────────────────┬───────────────┬───────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Installed Version │ Fixed Version │ Title │
├─────────────────┼────────────────┼──────────┼───────────────────┼───────────────┼───────────────────────────────────────────────────────────┤
│ libssl1.1 │ CVE-2023-0001 │ HIGH │ 1.1.1n-0+deb11u3 │ 1.1.1n-0+deb11u4 │ OpenSSL: Incorrect MAC check in AES_OCB mode │
│ libssl1.1 │ CVE-2023-0002 │ HIGH │ 1.1.1n-0+deb11u3 │ 1.1.1n-0+deb11u4 │ OpenSSL: NULL pointer dereference in RSA_padding_check │
│ libc6 │ CVE-2023-0003 │ MEDIUM │ 2.31-13+deb11u4 │ 2.31-13+deb11u5 │ glibc: Buffer overflow in iconv │
│ libc6 │ CVE-2023-0004 │ MEDIUM │ 2.31-13+deb11u4 │ 2.31-13+deb11u5 │ glibc: Use-after-free in getaddrinfo │
│ libc6 │ CVE-2023-0005 │ MEDIUM │ 2.31-13+deb11u4 │ 2.31-13+deb11u5 │ glibc: Heap-based buffer overflow in getaddrinfo │
│ libc6 │ CVE-2023-0006 │ MEDIUM │ 2.31-13+deb11u4 │ 2.31-13+deb11u5 │ glibc: Stack-based buffer overflow in getaddrinfo │
│ libc6 │ CVE-2023-0007 │ MEDIUM │ 2.31-13+deb11u4 │ 2.31-13+deb11u5 │ glibc: Out-of-bounds read in getaddrinfo │
│ libssl1.1 │ CVE-2023-0008 │ LOW │ 1.1.1n-0+deb11u3 │ 1.1.1n-0+deb11u4 │ OpenSSL: Information disclosure in OCSP Stapling │
│ libssl1.1 │ CVE-2023-0009 │ LOW │ 1.1.1n-0+deb11u3 │ 1.1.1n-0+deb11u4 │ OpenSSL: Timing attack in RSA padding │
│ libssl1.1 │ CVE-2023-0010 │ LOW │ 1.1.1n-0+deb11u3 │ 1.1.1n-0+deb11u4 │ OpenSSL: Padding oracle in PKCS#1 v1.5 decryption │
└─────────────────┴────────────────┴──────────┴───────────────────┴───────────────┴───────────────────────────────────────────────────────────┘

# 生成GPG密钥
$ gpg –gen-key

# 输出日志
gpg (GnuPG) 2.2.20;
libgcrypt 1.8.7

Home: /root/.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH, CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2

GnuPG needs to construct a user ID to identify your key.

Real name: fgedu
Email address: fgedu@example.com
You selected this USER-ID:
“fgedu ”

Change (N)ame, (E)mail, or (O)kay/(Q)uit? O

# 签名镜像
$ podman tag docker.io/library/httpd localhost/fgedu/httpd
$ podman push –sign-by fgedu@example.com localhost/fgedu/httpd

# 验证镜像签名
$ podman pull –verify=signature localhost/fgedu/httpd

# 切换到普通用户
$ su – fgedu

# 运行rootless容器
$ podman run -d –name fgedu-httpd docker.io/library/httpd

# 查看容器状态
$ podman ps

# 输出日志
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
7890123456ab docker.io/library/httpd httpd-foreground 2 minutes ago Up 2 minutes ago 0.0.0.0:8080->80/tcp fgedu-httpd

# 检查容器用户
$ podman exec fgedu-httpd id

# 输出日志
uid=1000(fgedu) gid=1000(fgedu) groups=1000(fgedu)

# 运行容器时限制权限
$ podman run -d –name fgedu-nginx \
–cap-drop ALL \
–security-opt no-new-privileges \
docker.io/library/nginx

# 查看容器权限
$ podman inspect fgedu-nginx | grep -A 10 “Capabilities”

# 输出日志（部分）
“Capabilities”: null,
“CapAdd”: [],
“CapDrop”: [
“ALL”
],
“SecurityOpt”: [
“no-new-privileges”
],

# 创建隔离网络
$ podman network create –internal fgedu-isolated-network

# 运行容器使用隔离网络
$ podman run -d –network fgedu-isolated-network –name fgedu-httpd docker.io/library/httpd

# 测试网络隔离
$ podman exec fgedu-httpd ping google.com

# 输出日志
ping: google.com: Name or service not known

# 允许容器端口访问
$ sudo firewall-cmd –add-port=8080/tcp –permanent
$ sudo firewall-cmd –reload

# 查看防火墙规则
$ sudo firewall-cmd –list-all

# 输出日志
public (active)
target: default
icmp-block-inversion: no
interfaces: eth0
sources:
services: ssh dhcpv6-client
ports: 8080/tcp
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules: