컨테이너 보안(Docker/Kubernetes)

Welcome to Container Security! Here, we'll explore how to protect your applications when they run inside containers like Docker and are orchestrated by systems like Kubernetes.

Containers offer great flexibility and efficiency, but they also introduce new security challenges that need careful attention.

Smaller container images mean less attack surface. Remove unnecessary tools, libraries, and files from your final image.

Using multi-stage builds and minimal base images (like Alpine Linux variants) are excellent strategies.

Always start with official and well-maintained base images from trusted registries. Unofficial images might contain vulnerabilities or even malicious code.

• Verify sources: Only pull images from reputable vendors or official repositories.
• Scan regularly: Even official images can have vulnerabilities; scan them often.

Run your containers with the minimum necessary permissions. This limits the damage if a container is compromised.

• Run as non-root: Avoid running processes as the root user inside the container.
• Drop capabilities: Remove Linux capabilities (e.g., NET_ADMIN, SYS_ADMIN) that your application doesn't need.

Integrate automated image scanning tools (like Trivy, Clair, or vulnerability scanners from cloud providers) into your CI/CD pipeline.

Scan images early and often to detect known vulnerabilities in your dependencies and operating system layers before deployment.

Network Policies in Kubernetes allow you to control which pods can communicate with each other and with external network endpoints.

By default, pods can communicate freely. Network policies enforce segmentation, creating a firewall around your pods.

Sensitive information like API keys, database passwords, and private certificates should never be hardcoded into images or configuration files.

Use Kubernetes Secrets, HashiCorp Vault, or cloud-specific secret managers to store and inject secrets securely at runtime.

Even with robust build-time security, runtime protection is crucial. Monitor container behavior for suspicious activities.

Tools like Falco can detect anomalous process execution, unauthorized file access, or unexpected network connections within your containers.

Security Contexts in Kubernetes allow you to define privilege and access control settings for a Pod or Container.

You can specify settings like running as a non-root user, dropping Linux capabilities, or configuring SELinux/AppArmor profiles.

Which of the following are best practices for securing container images?

In this lesson, we covered key aspects of securing containerized applications:

• Minimizing image size and using trusted base images.
• Applying the principle of least privilege.
• Regularly scanning images for vulnerabilities.
• Controlling network access with Kubernetes Network Policies.
• Managing secrets securely.
• Monitoring containers at runtime for suspicious activity.
• Enforcing security settings with Kubernetes Security Contexts.

By following these practices, you can significantly enhance the security posture of your Docker and Kubernetes deployments.