Cloud Expert
Container Security — Build to Runtime¶
KontejnerySecuritySupply ChainRuntime 5 min čtení
Image hardening, supply chain, runtime protection a scanning.
Build-time¶
FROM node:20-slim AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
RUN npm run build
FROM gcr.io/distroless/nodejs20-debian12
COPY --from=builder /app/dist /app
USER nonroot:nonroot
CMD ["server.js"]
Supply Chain¶
# Cosign signing
cosign sign --key cosign.key myregistry/myapp:v1.2.3
# Kyverno verification policy
spec:
rules:
- verifyImages:
- imageReferences: ["myregistry/*"]
Runtime¶
- Falco — syscall monitoring
- Seccomp profiles
- Read-only filesystem
- Resource limits
Shrnutí¶
Container security = distroless + signed supply chain + admission policies + runtime monitoring.
Potřebujete pomoct s implementací?¶
Náš tým má zkušenosti s návrhem a implementací moderních architektur. Rádi vám pomůžeme.