Docker安全加固：给容器加把锁

1
# ❌ 不推荐：单阶段构建（包含源代码和构建工具）
2
FROM golang:1.21 AS builder
3
WORKDIR /app
4
COPY . .
5
RUN go build -o myapp
6

7
FROM alpine:3.19
8
COPY --from=builder /app/myapp /usr/local/bin/myapp
9
# 最终镜像不包含源代码和Go编译器
10

11
# ✅ 推荐：多阶段构建
12
FROM golang:1.21-alpine AS builder
13
WORKDIR /app
14
COPY go.mod go.sum ./
15
RUN go mod download
16
COPY . .
17
RUN CGO_ENABLED=0 go build -o myapp
18

19
FROM alpine:3.19
20
RUN apk add --no-cache ca-certificates
21
COPY --from=builder /app/myapp /usr/local/bin/myapp
22
ENTRYPOINT ["/usr/local/bin/myapp"]

1
# 1. 使用特定版本的Alpine
2
FROM alpine:3.19.1
3

4
# 2. 添加标签（方便追踪）
5
LABEL maintainer="security@example.com" \
6
      version="1.0" \
7
      description="Secure base image"
8

9
# 3. 安装安全更新
10
RUN apk update && \
11
    apk upgrade && \
12
    apk add --no-cache \
13
    ca-certificates \
14
    curl \
15
    && rm -rf /var/cache/apk/*
16

17
# 4. 创建非root用户
18
RUN addgroup -g 1000 appuser && \
19
    adduser -D -u 1000 -G appuser appuser
20

21
# 5. 切换工作目录
22
WORKDIR /app
23

24
# 6. 复制依赖文件（利用Docker缓存）
25
COPY package*.json ./
26
RUN npm ci --only=production
27

28
# 7. 复制应用代码
29
COPY --chown=appuser:appuser . .
30

31
# 8. 切换到非root用户
32
USER appuser
33

34
# 9. 暴露端口
35
EXPOSE 3000
36

37
# 10. 健康检查
38
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
39
  CMD curl -f http://localhost:3000/health || exit 1
40

41
# 11. 使用exec形式（优雅关闭）
42
ENTRYPOINT ["node", "server.js"]

1
version: '3.8'
2

3
services:
4
  # Web应用
5
  app:
6
    image: my-app:1.0
7
    restart: unless-stopped
8
    # 资源限制
9
    deploy:
10
      resources:
11
        limits:
12
          cpus: '1'
13
          memory: 512M
14
        reservations:
15
          cpus: '0.5'
16
          memory: 128M
17
    # 只读文件系统
18
    read_only: true
19
    tmpfs:
20
      - /tmp
21
      - /app/cache
22
    # 非root用户
23
    user: "1000:1000"
24
    # 能力限制
25
    cap_drop:
26
      - ALL
27
    cap_add:
28
      - NET_BIND_SERVICE
29
    # 安全选项
30
    security_opt:
31
      - no-new-privileges:true
32
    # 环境变量
33
    env_file:
34
      - .env
35
    # 网络
36
    networks:
37
      - frontend
38
      - backend
39
    # 健康检查
40
    healthcheck:
41
      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
42
      interval: 30s
43
      timeout: 3s
44
      retries: 3
45
      start_period: 10s
46

47
  # 数据库
48
  postgres:
49
    image: postgres:14-alpine
50
    restart: unless-stopped
51
    # 资源限制
52
    deploy:
53
      resources:
54
        limits:
55
          cpus: '2'
56
          memory: 1G
57
    # 数据卷
58
    volumes:
59
      - postgres_data:/var/lib/postgresql/data
60
    # 环境变量
61
    env_file:
62
      - .env.db
63
    # 网络
64
    networks:
65
      - backend
66
    # 健康检查
67
    healthcheck:
68
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER}"]
69
      interval: 10s
70
      timeout: 5s
71
      retries: 5
72

73
  # Nginx反向代理
74
  nginx:
75
    image: nginx:alpine
76
    restart: unless-stopped
77
    # 只读文件系统
78
    read_only: true
79
    tmpfs:
80
      - /var/run
81
      - /var/cache/nginx
82
    # 能力限制
83
    cap_drop:
84
      - ALL
85
    cap_add:
86
      - NET_BIND_SERVICE
87
      - CHOWN
88
      - SETGID
89
    # 安全选项
90
    security_opt:
91
      - no-new-privileges:true
92
    # 配置文件
93
    volumes:
94
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
95
      - ./ssl:/etc/nginx/ssl:ro
96
    # 端口
97
    ports:
98
      - "80:80"
99
      - "443:443"
100
    # 网络
101
    networks:
102
      - frontend
103
    depends_on:
104
      - app
105

106
# 数据卷
107
volumes:
108
  postgres_data:
109
    driver: local
110

111
# 网络
112
networks:
113
  frontend:
114
    driver: bridge
115
  backend:
116
    driver: bridge
117
    internal: true  # 隔离网络，无法访问外网