Secure images and containers

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

$ als gewone gebruiker# als root (of met sudo)

Scan images for vulnerabilities

Scanners compare the packages in an image with vulnerability databases (CVEs).

$trivy image nginx:1.27
$trivy image --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 shop:dev
$trivy fs --scanners vuln,secret,misconfig .
$grype shop:dev
$docker scout cves shop:dev

Onthoud

Scan in CI on every build and regularly for images already running — new CVEs are found every day.

9.2

Make an SBOM

A Software Bill of Materials lists every package in the image. When a new vulnerability appears, you know at once which images contain it.

$syft shop:dev -o spdx-json > sbom.spdx.json
$trivy image --format cyclonedx --output sbom.cdx.json shop:dev
$grype sbom:./sbom.spdx.json

9.3

Sign and verify images

A signature proves who built an image and that it was not changed. cosign (Sigstore) signs with a key or keyless with the CI identity.

$cosign generate-key-pair
$cosign sign --key cosign.key ghcr.io/s0sta/shop@sha256:DIGEST
$cosign verify --key cosign.pub ghcr.io/s0sta/shop@sha256:DIGEST
$cosign attest --key cosign.key --type spdxjson --predicate sbom.spdx.json ghcr.io/s0sta/shop@sha256:DIGEST

Op het werk

Sign by digest, not by tag. In Kubernetes, an admission policy can then allow only signed images (see CKS supply chain).

9.4

Run containers with fewer rights

Take away everything the app does not need.

$docker run -d --name api \
    --user 1001:1001 \
    --read-only --tmpfs /tmp \
    --cap-drop ALL --cap-add NET_BIND_SERVICE \
    --security-opt no-new-privileges \
    --memory 512m --pids-limit 200 \
    myorg/api:2.0

Setting	Stops
`--user` (non-root)	Root power if the app is hacked
`--read-only`	Changes to the app files, dropped malware
`--cap-drop ALL`	Root powers like changing the network or mounting
`no-new-privileges`	SUID programs giving more rights
Limits	One container taking the whole host down

Let op

Never use --privileged, never mount /var/run/docker.sock into a container (it is root on the host), and avoid --network host and --pid host.

9.5

Keep secrets out of images

Anything in a layer can be read by anyone with the image — even if a later layer deletes it.

$docker build --secret id=npmrc,src=$HOME/.npmrc -t web:dev .
$docker run -d --name api -v /run/secrets/db:/run/secrets/db:ro myorg/api:2.0

Dockerfile (build secret)

RUN --mount=type=secret,id=npmrc,target=/root/.npmrc npm ci

9.6

Check the host and the daemon

The host matters too: patched kernel, rootless engine where possible, and the CIS benchmark.

$podman info --format '{{.Host.Security.Rootless}}'
$docker run --rm --net host --pid host --cap-add audit_control -v /etc:/etc:ro -v /var/lib:/var/lib:ro -v /var/run/docker.sock:/var/run/docker.sock:ro docker/docker-bench-security

Alle commando's in dit hoofdstuk