ProHoster > Blog > Administrasi > Métode sareng conto palaksanaan utilitas cek kaamanan Docker

Métode sareng conto palaksanaan utilitas cek kaamanan Docker

Métode sareng conto palaksanaan utilitas cek kaamanan Docker
Héy Habr!

Dina kanyataan ayeuna, kusabab ngaronjatna peran containerization dina prosés pangwangunan, masalah pikeun mastikeun kaamanan rupa-rupa tahapan sareng éntitas anu aya hubunganana sareng wadah henteu aya dina tempat anu terakhir. Ngalaksanakeun cék sacara manual mangrupikeun tugas anu susah, janten langkung saé nyandak sahenteuna léngkah-léngkah awal pikeun ngajadikeun otomatis prosés ieu.

Dina tulisan ieu, kuring bakal ngabagi skrip anu siap-siap pikeun ngalaksanakeun sababaraha utilitas kaamanan Docker sareng petunjuk ngeunaan cara nyetél demo leutik pikeun nguji prosés ieu. Anjeun tiasa nganggo bahan pikeun ékspérimén kumaha ngatur prosés nguji kaamanan gambar sareng petunjuk Dockerfile. Éta jelas yén pangwangunan sareng palaksanaan infrastruktur béda pikeun sadayana, janten di handap ieu kuring bakal masihan sababaraha pilihan anu mungkin.

Utiliti Cék Kaamanan

Aya sajumlah ageung aplikasi pembantu sareng skrip anu ngalakukeun cek dina sagala rupa aspék infrastruktur Docker. Sababaraha di antarana geus dijelaskeun dina artikel saméméhna (https://habr.com/ru/company/swordfish_security/blog/518758/#docker-security), sareng dina tulisan ieu kuring hoyong difokuskeun tilu di antarana, anu nutupan seueur syarat kaamanan pikeun gambar Docker anu diwangun nalika prosés pangwangunan. Salaku tambahan, kuring ogé bakal nunjukkeun conto kumaha tilu utilitas ieu tiasa digabungkeun kana hiji pipa pikeun ngalaksanakeun pamariksaan kaamanan.

Hadolin
https://github.com/hadolint/hadolint

Utilitas konsol anu cukup saderhana anu ngabantosan mimiti ngira-ngira kabeneran sareng kasalametan petunjuk Dockerfile (contona, ngan ukur nganggo pendaptaran gambar anu diidinan atanapi nganggo sudo).

Métode sareng conto palaksanaan utilitas cek kaamanan Docker

Dokel
https://github.com/goodwithtech/dockle

Utilitas konsol anu dianggo dina gambar (atanapi dina tarball gambar anu disimpen) anu mariksa kabeneran sareng kaamanan gambar tinangtu sapertos kitu ku nganalisa lapisan sareng konfigurasina - naon anu didamel ku pangguna, petunjuk naon anu dianggo, volume naon anu dipasang. , ayana kecap akses kosong, jsb e.. Sedengkeun jumlah cék teu pisan badag sarta dumasar kana sababaraha cék sarta rekomendasi sorangan. CIS (Puseur pikeun Internet Kaamanan) Patokan pikeun docker.
Métode sareng conto palaksanaan utilitas cek kaamanan Docker

Trivy
https://github.com/aquasecurity/trivy

Utilitas ieu ditujukeun pikeun mendakan dua jinis kerentanan - masalah ngawangun OS (Alpine, RedHat (EL), CentOS, Debian GNU, Ubuntu dirojong) sareng masalah kagumantungan (Gemfile.lock, Pipfile.lock, composer.lock, package-lock. .json , yarn.lock, Cargo.lock). Trivy tiasa nyeken duanana gambar dina Repository jeung gambar lokal, sarta ogé nyeken dumasar kana file .tar ditransfer kalawan gambar Docker.

Métode sareng conto palaksanaan utilitas cek kaamanan Docker

Pilihan Palaksanaan Utiliti

Pikeun nyobaan aplikasi anu dijelaskeun dina kaayaan terasing, kuring bakal nyayogikeun pitunjuk pikeun masang sadaya utilitas salaku bagian tina prosés anu saderhana.

Gagasan utama nyaéta nunjukkeun kumaha anjeun tiasa ngalaksanakeun pamariksaan eusi otomatis pikeun Dockerfiles sareng gambar Docker anu didamel nalika pangwangunan.

Verifikasi sorangan diwangun ku léngkah-léngkah ieu:

  1. Mariksa kabeneran sareng kasalametan petunjuk Dockerfile nganggo utilitas linter Hadolin
  2. Mariksa kabeneran sareng kaamanan gambar ahir sareng panengah - utilitas Dokel
  3. Mariksa Kerentanan Umum (CVE) dina gambar dasar sareng sajumlah dependensi - ku utilitas Trivy

Engké dina tulisan kuring bakal masihan tilu pilihan pikeun ngalaksanakeun léngkah-léngkah ieu:
Anu kahiji nyaéta ku ngonpigurasikeun pipa CI / CD nganggo conto GitLab (kalayan pedaran prosés naékkeun conto tés).
Anu kadua ngagunakeun skrip cangkang.
Anu katilu nyaéta ngawangun gambar Docker pikeun nyeken gambar Docker.
Anjeun tiasa milih pilihan anu paling cocog pikeun anjeun, mindahkeun kana infrastruktur anjeun sareng adaptasi kana kabutuhan anjeun.

Sadaya file anu diperyogikeun sareng petunjuk tambahan ogé aya dina gudang: https://github.com/Swordfish-Security/docker_cicd

Integrasi GitLab CI/CD

Dina pilihan kahiji, urang bakal ningali kumaha cék kaamanan tiasa dilaksanakeun nganggo sistem gudang GitLab sabagé conto. Di dieu urang bakal ngaliwat léngkah-léngkah sareng ningali kumaha nyetél lingkungan uji sareng GitLab ti mimiti, nyiptakeun prosés scan sareng ngajalankeun utiliti pikeun nguji Dockerfile sareng gambar acak - aplikasi JuiceShop.

Masang GitLab
1. Pasang Docker:

sudo apt-get update && sudo apt-get install docker.io

2. Tambihkeun pangguna ayeuna ka grup docker supados anjeun tiasa damel sareng docker tanpa nganggo sudo:

sudo addgroup <username> docker

3. Panggihan IP anjeun:

ip addr

4. Pasang sareng jalankeun GitLab dina wadahna, ngagentos alamat IP dina hostname sareng anjeun sorangan:

docker run --detach 
--hostname 192.168.1.112 
--publish 443:443 --publish 80:80 
--name gitlab 
--restart always 
--volume /srv/gitlab/config:/etc/gitlab 
--volume /srv/gitlab/logs:/var/log/gitlab 
--volume /srv/gitlab/data:/var/opt/gitlab 
gitlab/gitlab-ce:latest

Kami ngantosan GitLab pikeun ngarengsekeun sadaya prosedur instalasi anu diperyogikeun (anjeun tiasa nuturkeun prosés ngalangkungan kaluaran file log: docker logs -f gitlab).

5. Buka IP lokal anjeun dina browser tur tingal kaca nu nawarkeun pikeun ngarobah sandi pikeun pamaké root:
Métode sareng conto palaksanaan utilitas cek kaamanan Docker
Setel kecap akses anyar sareng angkat ka GitLab.

6. Jieun proyék anyar, contona cicd-test na initialize eta kalawan file ngamimitian README.md:
Métode sareng conto palaksanaan utilitas cek kaamanan Docker
7. Ayeuna urang kudu masang GitLab runner: agén anu bakal ngajalankeun sagala operasi diperlukeun dina pamundut.
Unduh versi panganyarna (dina hal ieu, dina Linux 64-bit):

sudo curl -L --output /usr/local/bin/gitlab-runner https://gitlab-runner-downloads.s3.amazonaws.com/latest/binaries/gitlab-runner-linux-amd64

8. Jieun eta laksana:

sudo chmod +x /usr/local/bin/gitlab-runner

9. Tambahkeun pamaké OS pikeun Runner tur mimitian layanan:

sudo useradd --comment 'GitLab Runner' --create-home gitlab-runner --shell /bin/bash
sudo gitlab-runner install --user=gitlab-runner --working-directory=/home/gitlab-runner
sudo gitlab-runner start

Éta kedah katingali sapertos kieu:

local@osboxes:~$ sudo gitlab-runner install --user=gitlab-runner --working-directory=/home/gitlab-runner
Runtime platform arch=amd64 os=linux pid=8438 revision=0e5417a3 version=12.0.1
local@osboxes:~$ sudo gitlab-runner start
Runtime platform arch=amd64 os=linux pid=8518 revision=0e5417a3 version=12.0.1

10. Ayeuna urang ngadaptarkeun Runner supados tiasa berinteraksi sareng conto GitLab urang.
Jang ngalampahkeun ieu, buka kaca Setélan-CI/CD (http://OUR_ IP_ADDRESS/root/cicd-test/-/settings/ci_cd) jeung dina tab Runners manggihan URL na token Pendaftaran:
Métode sareng conto palaksanaan utilitas cek kaamanan Docker
11. Ngadaptarkeun Runner ku ngagentos URL sareng token Pendaftaran:

sudo gitlab-runner register 
--non-interactive 
--url "http://<URL>/" 
--registration-token "<Registration Token>" 
--executor "docker" 
--docker-privileged 
--docker-image alpine:latest 
--description "docker-runner" 
--tag-list "docker,privileged" 
--run-untagged="true" 
--locked="false" 
--access-level="not_protected"

Hasilna, urang kéngingkeun GitLab anu siap-siap, dimana urang kedah nambihan petunjuk pikeun ngamimitian utilitas urang. Dina demo ieu, urang teu boga aplikasi ngawangun sarta containerization léngkah, tapi dina lingkungan nyata maranéhna bakal miheulaan léngkah scan sarta ngahasilkeun gambar sarta Dockerfile pikeun analisis.

konfigurasi pipa

1. Tambahkeun file ka gudang mydockerfile.df (ieu mangrupikeun tés Dockerfile anu bakal urang uji) sareng file konfigurasi prosés GitLab CI / CD .gitlab-cicd.yml, nu mangrupa daptar parentah pikeun scanner (catetan titik dina ngaran file).

file konfigurasi .yaml ngandung parentah pikeun ngajalankeun tilu Utiliti (Hadolint, Dockle, sarta Trivy) anu bakal parse Dockerfile dipilih jeung gambar dieusian dina variabel DOCKERFILE. Sadaya file anu diperyogikeun tiasa dicandak tina gudang: https://github.com/Swordfish-Security/docker_cicd/

Ékstrak ti mydockerfile.df (Ieu mangrupikeun file abstrak sareng sakumpulan petunjuk anu sawenang-wenang pikeun nunjukkeun kumaha utilitasna jalan). Tautan langsung kana file: mydockerfile.df

Eusi mydockerfile.df

FROM amd64/node:10.16.0-alpine@sha256:f59303fb3248e5d992586c76cc83e1d3700f641cbcd7c0067bc7ad5bb2e5b489 AS tsbuild
COPY package.json .
COPY yarn.lock .
RUN yarn install
COPY lib lib
COPY tsconfig.json tsconfig.json
COPY tsconfig.app.json tsconfig.app.json
RUN yarn build
FROM amd64/ubuntu:18.04@sha256:eb70667a801686f914408558660da753cde27192cd036148e58258819b927395
LABEL maintainer="Rhys Arkins <[email protected]>"
LABEL name="renovate"
...
COPY php.ini /usr/local/etc/php/php.ini
RUN cp -a /tmp/piik/* /var/www/html/
RUN rm -rf /tmp/piwik
RUN chown -R www-data /var/www/html
ADD piwik-cli-setup /piwik-cli-setup
ADD reset.php /var/www/html/
## ENTRYPOINT ##
ADD entrypoint.sh /entrypoint.sh
ENTRYPOINT ["/entrypoint.sh"]
USER root

Konfigurasi YAML sapertos kieu (filena tiasa dicandak tina tautan langsung di dieu: .gitlab-ci.yml):

Eusi .gitlab-ci.yml

variables:
    DOCKER_HOST: "tcp://docker:2375/"
    DOCKERFILE: "mydockerfile.df" # name of the Dockerfile to analyse   
    DOCKERIMAGE: "bkimminich/juice-shop" # name of the Docker image to analyse
    # DOCKERIMAGE: "knqyf263/cve-2018-11235" # test Docker image with several CRITICAL CVE
    SHOWSTOPPER_PRIORITY: "CRITICAL" # what level of criticality will fail Trivy job
    TRIVYCACHE: "$CI_PROJECT_DIR/.cache" # where to cache Trivy database of vulnerabilities for faster reuse
    ARTIFACT_FOLDER: "$CI_PROJECT_DIR"
 
services:
    - docker:dind # to be able to build docker images inside the Runner
 
stages:
    - scan
    - report
    - publish
 
HadoLint:
    # Basic lint analysis of Dockerfile instructions
    stage: scan
    image: docker:git
 
    after_script:
    - cat $ARTIFACT_FOLDER/hadolint_results.json
 
    script:
    - export VERSION=$(wget -q -O - https://api.github.com/repos/hadolint/hadolint/releases/latest | grep '"tag_name":' | sed -E 's/.*"v([^"]+)".*/1/')
    - wget https://github.com/hadolint/hadolint/releases/download/v${VERSION}/hadolint-Linux-x86_64 && chmod +x hadolint-Linux-x86_64
     
    # NB: hadolint will always exit with 0 exit code
    - ./hadolint-Linux-x86_64 -f json $DOCKERFILE > $ARTIFACT_FOLDER/hadolint_results.json || exit 0
 
    artifacts:
        when: always # return artifacts even after job failure       
        paths:
        - $ARTIFACT_FOLDER/hadolint_results.json
 
Dockle:
    # Analysing best practices about docker image (users permissions, instructions followed when image was built, etc.)
    stage: scan   
    image: docker:git
 
    after_script:
    - cat $ARTIFACT_FOLDER/dockle_results.json
 
    script:
    - export VERSION=$(wget -q -O - https://api.github.com/repos/goodwithtech/dockle/releases/latest | grep '"tag_name":' | sed -E 's/.*"v([^"]+)".*/1/')
    - wget https://github.com/goodwithtech/dockle/releases/download/v${VERSION}/dockle_${VERSION}_Linux-64bit.tar.gz && tar zxf dockle_${VERSION}_Linux-64bit.tar.gz
    - ./dockle --exit-code 1 -f json --output $ARTIFACT_FOLDER/dockle_results.json $DOCKERIMAGE   
     
    artifacts:
        when: always # return artifacts even after job failure       
        paths:
        - $ARTIFACT_FOLDER/dockle_results.json
 
Trivy:
    # Analysing docker image and package dependencies against several CVE bases
    stage: scan   
    image: docker:git
 
    script:
    # getting the latest Trivy
    - apk add rpm
    - export VERSION=$(wget -q -O - https://api.github.com/repos/knqyf263/trivy/releases/latest | grep '"tag_name":' | sed -E 's/.*"v([^"]+)".*/1/')
    - wget https://github.com/knqyf263/trivy/releases/download/v${VERSION}/trivy_${VERSION}_Linux-64bit.tar.gz && tar zxf trivy_${VERSION}_Linux-64bit.tar.gz
     
    # displaying all vulnerabilities w/o failing the build
    - ./trivy -d --cache-dir $TRIVYCACHE -f json -o $ARTIFACT_FOLDER/trivy_results.json --exit-code 0 $DOCKERIMAGE    
    
    # write vulnerabilities info to stdout in human readable format (reading pure json is not fun, eh?). You can remove this if you don't need this.
    - ./trivy -d --cache-dir $TRIVYCACHE --exit-code 0 $DOCKERIMAGE    
 
    # failing the build if the SHOWSTOPPER priority is found
    - ./trivy -d --cache-dir $TRIVYCACHE --exit-code 1 --severity $SHOWSTOPPER_PRIORITY --quiet $DOCKERIMAGE
         
    artifacts:
        when: always # return artifacts even after job failure
        paths:
        - $ARTIFACT_FOLDER/trivy_results.json
 
    cache:
        paths:
        - .cache
 
Report:
    # combining tools outputs into one HTML
    stage: report
    when: always
    image: python:3.5
     
    script:
    - mkdir json
    - cp $ARTIFACT_FOLDER/*.json ./json/
    - pip install json2html
    - wget https://raw.githubusercontent.com/shad0wrunner/docker_cicd/master/convert_json_results.py
    - python ./convert_json_results.py
     
    artifacts:
        paths:
        - results.html

Upami diperyogikeun, anjeun ogé tiasa nyeken gambar anu disimpen salaku arsip .tar (najan kitu, anjeun kedah ngarobih parameter input pikeun utiliti dina file YAML)

NB: Trivy peryogi dipasang rpm и séwang. Upami teu kitu, éta bakal ngahasilkeun kasalahan nalika nyeken gambar basis RedHat sareng kéngingkeun apdet kana database kerentanan.

2. Saatos nambahkeun payil kana Repository nu, nurutkeun parentah dina file konfigurasi urang, GitLab otomatis bakal ngamimitian ngawangun sarta prosés scan. Dina tab CI / CD → Pipelines, anjeun tiasa ningali kamajuan paréntah.

Hasilna, urang gaduh opat tugas. Tilu di antarana anu langsung aub dina scanning, sarta panungtungan (Laporan) ngumpulkeun laporan basajan tina file sumebar kalawan hasil scan.
Métode sareng conto palaksanaan utilitas cek kaamanan Docker
Sacara standar, Trivy ngeureunkeun palaksanaanna upami kerentanan KRITIS kapanggih dina gambar atanapi dependensi. Dina waktos anu sami, Hadolint sok ngabalikeun Kasuksesan dina kode eksekusi, sabab palaksanaanna sok aya koméntar, anu nyababkeun pangwangunanna eureun.

Gumantung kana sarat husus Anjeun, Anjeun bisa ngonpigurasikeun hiji kode kaluar ambéh Utiliti ieu ogé ngeureunkeun prosés ngawangun lamun masalah tina hiji criticality tangtu dideteksi. Dina kasus urang, wangunan bakal eureun ngan lamun Trivy ngadeteksi kerentanan kalayan severity nu urang geus dieusian dina variabel SHOWSTOPPER di .gitlab-ci.yml.
Métode sareng conto palaksanaan utilitas cek kaamanan Docker

Hasil operasi unggal utilitas tiasa ditingali dina log unggal tugas panyeken, langsung dina file json dina bagian artefak, atanapi dina laporan HTML saderhana (langkung seueur ngeunaan éta di handap):
Métode sareng conto palaksanaan utilitas cek kaamanan Docker

3. Pikeun nampilkeun laporan utiliti dina formulir rada leuwih bisa dibaca manusa, Aksara Python leutik dipaké pikeun ngarobah tilu file json kana hiji file HTML kalawan tabel defects.
Skrip ieu diluncurkeun ku tugas Laporan anu misah, sareng artefak ahirna mangrupikeun file HTML sareng laporan. Sumber naskah ogé aya dina gudang sareng tiasa diadaptasi pikeun kabutuhan, warna, jsb.
Métode sareng conto palaksanaan utilitas cek kaamanan Docker

Aksara cangkang

Pilihan kadua cocog pikeun kasus dimana anjeun kedah parios gambar Docker henteu aya dina sistem CI / CD, atanapi anjeun kedah gaduh sadayana petunjuk dina bentuk anu tiasa dilaksanakeun langsung dina host. Pilihan ieu katutupan ku skrip cangkang anu siap-siap anu tiasa dijalankeun dina mesin virtual anu bersih (atanapi nyata). Skrip nuturkeun paréntah anu sami sareng gitlab-runner di luhur.

Pikeun skrip tiasa suksés, Docker kedah dipasang dina sistem sareng pangguna ayeuna kedah aya dina grup docker.

Skrip sorangan tiasa dipendakan di dieu: docker_sec_check.sh

Dina awal file, variabel nangtukeun gambar mana anu kedah diseken sareng naon parahna cacad anu bakal nyababkeun utilitas Trivy kaluar sareng kode kasalahan anu ditangtukeun.

Salila palaksanaan skrip, sadaya utilitas bakal diunduh kana diréktori docker_tools, hasil karya maranéhanana - dina diréktori docker_tools/json, sareng HTML sareng laporan bakal aya dina file hasil.html.

Output naskah conto

~/docker_cicd$ ./docker_sec_check.sh

[+] Setting environment variables
[+] Installing required packages
[+] Preparing necessary directories
[+] Fetching sample Dockerfile
2020-10-20 10:40:00 (45.3 MB/s) - ‘Dockerfile’ saved [8071/8071]
[+] Pulling image to scan
latest: Pulling from bkimminich/juice-shop
[+] Running Hadolint
...
Dockerfile:205 DL3015 Avoid additional packages by specifying `--no-install-recommends`
Dockerfile:248 DL3002 Last USER should not be root
...
[+] Running Dockle
...
WARN    - DKL-DI-0006: Avoid latest tag
        * Avoid 'latest' tag
INFO    - CIS-DI-0005: Enable Content trust for Docker
        * export DOCKER_CONTENT_TRUST=1 before docker pull/build
...
[+] Running Trivy
juice-shop/frontend/package-lock.json
=====================================
Total: 3 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 2, CRITICAL: 0)

+---------------------+------------------+----------+---------+-------------------------+
|       LIBRARY       | VULNERABILITY ID | SEVERITY | VERSION |             TITLE       |
+---------------------+------------------+----------+---------+-------------------------+
| object-path         | CVE-2020-15256   | HIGH     | 0.11.4  | Prototype pollution in  |
|                     |                  |          |         | object-path             |
+---------------------+------------------+          +---------+-------------------------+
| tree-kill           | CVE-2019-15599   |          | 1.2.2   | Code Injection          |
+---------------------+------------------+----------+---------+-------------------------+
| webpack-subresource | CVE-2020-15262   | LOW      | 1.4.1   | Unprotected dynamically |
|                     |                  |          |         | loaded chunks           |
+---------------------+------------------+----------+---------+-------------------------+

juice-shop/package-lock.json
============================
Total: 20 (UNKNOWN: 0, LOW: 1, MEDIUM: 6, HIGH: 8, CRITICAL: 5)

...

juice-shop/package-lock.json
============================
Total: 5 (CRITICAL: 5)

...
[+] Removing left-overs
[+] Making the output look pretty
[+] Converting JSON results
[+] Writing results HTML
[+] Clean exit ============================================================
[+] Everything is done. Find the resulting HTML report in results.html

Gambar Docker sareng sadaya utilitas

Salaku alternatif katilu, kuring nyusun dua Dockerfiles saderhana pikeun nyiptakeun gambar nganggo utilitas kaamanan. Hiji Dockerfile bakal ngabantosan ngawangun set pikeun nyeken gambar tina gudang, anu kadua (Dockerfile_tar) bakal ngawangun set pikeun nyeken file tar sareng gambar.

1. Simkuring nyandak file Docker luyu jeung Aksara tina Repository nu https://github.com/Swordfish-Security/docker_cicd/tree/master/Dockerfile.
2. Jalankeun pikeun assembly:

docker build -t dscan:image -f docker_security.df .

3. Saatos ngawangun réngsé, jieun wadah tina gambar. Dina waktos anu sami, urang lulus variabel lingkungan DOCKERIMAGE kalayan nami gambar anu urang pikahoyong sareng pasang Dockerfile anu badé dianalisis tina mesin urang kana file. /dockerfile (Catetan yén jalur mutlak pikeun file ieu diperyogikeun):

docker run --rm -v $(pwd)/results:/results -v $(pwd)/docker_security.df:/Dockerfile -e DOCKERIMAGE="bkimminich/juice-shop" dscan:image


[+] Setting environment variables
[+] Running Hadolint
/Dockerfile:3 DL3006 Always tag the version of an image explicitly
[+] Running Dockle
WARN    - DKL-DI-0006: Avoid latest tag
        * Avoid 'latest' tag
INFO    - CIS-DI-0005: Enable Content trust for Docker
        * export DOCKER_CONTENT_TRUST=1 before docker pull/build
INFO    - CIS-DI-0006: Add HEALTHCHECK instruction to the container image
        * not found HEALTHCHECK statement
INFO    - DKL-LI-0003: Only put necessary files
        * unnecessary file : juice-shop/node_modules/sqlite3/Dockerfile
        * unnecessary file : juice-shop/node_modules/sqlite3/tools/docker/architecture/linux-arm64/Dockerfile
        * unnecessary file : juice-shop/node_modules/sqlite3/tools/docker/architecture/linux-arm/Dockerfile
[+] Running Trivy
...
juice-shop/package-lock.json
============================
Total: 20 (UNKNOWN: 0, LOW: 1, MEDIUM: 6, HIGH: 8, CRITICAL: 5)
...
[+] Making the output look pretty
[+] Starting the main module ============================================================
[+] Converting JSON results
[+] Writing results HTML
[+] Clean exit ============================================================
[+] Everything is done. Find the resulting HTML report in results.html

Hasil

Kami parantos nutupan ngan ukur hiji set dasar utilitas scanning artefak Docker, anu kuring pikir nyertakeun bagian anu hadé tina syarat kaamanan gambar sacara efektif. Aya seueur alat anu mayar sareng gratis anu tiasa ngalakukeun cek anu sami, ngagambar laporan anu saé atanapi tiasa dianggo dina modeu konsol, nutupan sistem manajemen wadahna, jsb.

Sisi positip tina set alat anu dijelaskeun dina tulisan nyaéta aranjeunna sadayana diwangun dina sumber terbuka sareng anjeun tiasa ékspérimén sareng alat-alat anu sanés pikeun milari naon anu cocog sareng kabutuhan sareng fitur infrastruktur anjeun. Tangtosna, sadaya kerentanan anu dipendakan kedah diulik pikeun tiasa dianggo dina kaayaan khusus, tapi ieu mangrupikeun topik pikeun tulisan ageung anu bakal datang.

Kuring miharep parentah ieu, Aksara jeung Utiliti baris mantuan anjeun sarta jadi titik awal pikeun nyieun hiji infrastruktur leuwih aman dina widang containerization.

sumber: www.habr.com

Tambahkeun komentar