Secure Coding & OWASP Top 10 for Backend · 课时

容器安全（Docker/Kubernetes）

学习使用 Docker 和 Kubernetes 安全地构建、部署和管理容器化应用程序，包括镜像扫描和网络策略。

容器安全（Docker/Kubernetes） 是 CoddyKit 上的免费 Secure Coding & OWASP Top 10 for Backend 课时。这是第 2 节课，共 4 节。你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。这是 Secure Coding & OWASP Top 10 for Backend 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 Secure Coding & OWASP Top 10 for Backend 课程共包含 4 节课。

本课时的部分内容尚未翻译，以英文显示。

Introduction to Container Security

Welcome to Container Security! Here, we'll explore how to protect your applications when they run inside containers like Docker and are orchestrated by systems like Kubernetes.

Containers offer great flexibility and efficiency, but they also introduce new security challenges that need careful attention.

Minimize Container Images

Smaller container images mean less attack surface. Remove unnecessary tools, libraries, and files from your final image.

Using multi-stage builds and minimal base images (like Alpine Linux variants) are excellent strategies.

FROM openjdk:17-jdk-slim AS builder
WORKDIR /app
COPY . .
RUN javac Main.java

FROM openjdk:17-jre-slim
WORKDIR /app
COPY --from=builder /app/Main.class .
CMD ["java", "Main"]

Use Trusted Base Images

Always start with official and well-maintained base images from trusted registries. Unofficial images might contain vulnerabilities or even malicious code.

Verify sources: Only pull images from reputable vendors or official repositories.
Scan regularly: Even official images can have vulnerabilities; scan them often.

Principle of Least Privilege

Run your containers with the minimum necessary permissions. This limits the damage if a container is compromised.

Run as non-root: Avoid running processes as the root user inside the container.
Drop capabilities: Remove Linux capabilities (e.g., NET_ADMIN, SYS_ADMIN) that your application doesn't need.

docker run --user 1000:1000 \
  --cap-drop=ALL \
  my-secure-app

Scan Container Images for Vulnerabilities

Integrate automated image scanning tools (like Trivy, Clair, or vulnerability scanners from cloud providers) into your CI/CD pipeline.

Scan images early and often to detect known vulnerabilities in your dependencies and operating system layers before deployment.

Kubernetes Network Policies

Network Policies in Kubernetes allow you to control which pods can communicate with each other and with external network endpoints.

By default, pods can communicate freely. Network policies enforce segmentation, creating a firewall around your pods.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all-ingress
  namespace: default
spec:
  podSelector: {}
  policyTypes:
    - Ingress

Secure Secrets Management

Sensitive information like API keys, database passwords, and private certificates should never be hardcoded into images or configuration files.

Use Kubernetes Secrets, HashiCorp Vault, or cloud-specific secret managers to store and inject secrets securely at runtime.

apiVersion: v1
kind: Secret
metadata:
  name: my-app-secret
type: Opaque
data:
  api_key: YmFzZTY0ZW5jb2RlZHNlY3JldA== # base64 encoded value
  db_password: cGFzc3dvcmQ=

Runtime Security & Monitoring

Even with robust build-time security, runtime protection is crucial. Monitor container behavior for suspicious activities.

Tools like Falco can detect anomalous process execution, unauthorized file access, or unexpected network connections within your containers.

Kubernetes Security Contexts

Security Contexts in Kubernetes allow you to define privilege and access control settings for a Pod or Container.

You can specify settings like running as a non-root user, dropping Linux capabilities, or configuring SELinux/AppArmor profiles.

apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 2000
  containers:
  - name: my-container
    image: my-image
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop: ["ALL"]

Quick Check: Image Security

Which of the following are best practices for securing container images?

Container Security Recap

In this lesson, we covered key aspects of securing containerized applications:

Minimizing image size and using trusted base images.
Applying the principle of least privilege.
Regularly scanning images for vulnerabilities.
Controlling network access with Kubernetes Network Policies.
Managing secrets securely.
Monitoring containers at runtime for suspicious activity.
Enforcing security settings with Kubernetes Security Contexts.

By following these practices, you can significantly enhance the security posture of your Docker and Kubernetes deployments.

常见问题解答

「容器安全（Docker/Kubernetes）」课时是免费的吗？

是的 — 「容器安全（Docker/Kubernetes）」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 Secure Coding & OWASP Top 10 for Backend 课程的其余内容，请升级到 CoddyKit PRO。 Secure Coding & OWASP Top 10 for Backend 课程共包含 4 节课。

「容器安全（Docker/Kubernetes）」这节课中我会学到什么？

学习使用 Docker 和 Kubernetes 安全地构建、部署和管理容器化应用程序，包括镜像扫描和网络策略。你通过在浏览器中直接运行的动手代码来练习 Secure Coding & OWASP Top 10 for Backend，全天候 AI 导师会在你学习这节课的过程中回答你的问题。

学习 Secure Coding & OWASP Top 10 for Backend 需要有经验吗？

无需任何先前经验。CoddyKit 上的 Secure Coding & OWASP Top 10 for Backend 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。这是第 2 节课，共 4 节。

「容器安全（Docker/Kubernetes）」课时需要多长时间？

大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。

我能在这节 Secure Coding & OWASP Top 10 for Backend 课中编写并运行代码吗？

能。每节 Secure Coding & OWASP Top 10 for Backend 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。

此课程中的所有课时

← 返回 Secure Coding & OWASP Top 10 for Backend