ããªã·ãŒã§ Docker Hardened Images ã®äœ¿çšã匷å¶ãã
Docker Hardened ImageïŒDHIïŒãªããžããªããã©ãŒãªã³ã°ãããšãèªåçã« Docker Scout ãæå¹ã«ãªãã远å èšå®ãªãã§ã»ãã¥ãªãã£ããã³ã³ã³ãã©ã€ã¢ã³ã¹ããªã·ãŒã®é©çšãéå§ã§ããŸãã
Docker Scout ã®ããªã·ãŒæ©èœã䜿ãã°ãDHI ãããŒã¹ãšããæ¿èªæžã¿ãã€ã»ãã¥ã¢ãªã€ã¡ãŒãžã®ã¿ãç°å¢å šäœã§äœ¿çšã§ããããã«ããã«ãŒã«ãå®çŸ©ã»é©çšã§ããŸãã
ããªã·ãŒè©äŸ¡ã¯ Docker Scout ã«çµã¿èŸŒãŸããŠããããªã¢ã«ã¿ã€ã ã§ã®ã³ã³ãã©ã€ã¢ã³ã¹ç£èŠãCI/CD ã¯ãŒã¯ãããŒãžã®ãã§ãã¯çµ±åããããŠã€ã¡ãŒãžã®ã»ãã¥ãªãã£ãšããããã³ã¹ã«é¢ããäžè²«ããåºæºã®ç¶æãå¯èœã«ãªããŸãã
æ¢åã®ããªã·ãŒã確èªãã
ãã©ãŒãªã³ã°ããã DHI ãªããžããªã«é©çšãããŠããçŸåšã®ããªã·ãŒã確èªããã«ã¯ïŒ
-
Docker Hubâ äžã®ãã©ãŒãªã³ã°æžã¿ DHI ãªããžããªã«ã¢ã¯ã»ã¹ããŸãã
-
View on Scout ãéžæããŸãã
ãã®æäœã«ãããDocker Scout ããã·ã¥ããŒãâ ãéããçŸåšæå¹ãªããªã·ãŒããã€ã¡ãŒãžãããªã·ãŒåºæºãæºãããŠãããã©ããã確èªã§ããŸãã
Docker Scout ã¯ãæ°ããã€ã¡ãŒãžã push ããããã³ã«èªåçã«ããªã·ãŒé©åæ§ãè©äŸ¡ããŸãã
åããªã·ãŒã«ã¯ãã³ã³ãã©ã€ã¢ã³ã¹çµæãšã圱é¿ãåããã€ã¡ãŒãžãã¬ã€ã€ãŒãžã®ãªã³ã¯ã衚瀺ãããŸãã
DHI ããŒã¹ã®ã€ã¡ãŒãžã«å¯ŸããŠããªã·ãŒãäœæãã
Docker Hardened Images ã䜿çšããŠãã«ãããã€ã¡ãŒãžã®ã»ãã¥ãªãã£ã確ä¿ããããã«ãèªç€Ÿãªããžããªã«å¯ŸããŠèŠä»¶ã«å¿ãã Docker Scout ããªã·ãŒãäœæã§ããŸãã
ãããã®ããªã·ãŒã掻çšããããšã§ã以äžã®ãããªã»ãã¥ãªãã£åºæºã匷å¶ã§ããŸã:
-
髿·±å»åºŠã®è匱æ§ãå«ãã€ã¡ãŒãžã®çŠæ¢
-
ææ°ã®ããŒã¹ã€ã¡ãŒãžã®äœ¿çšå¿ é
-
SBOM ãããããã³ã¹ãªã©ãå¿ èŠãªã¡ã¿ããŒã¿ã®ååšç¢ºèª
ããªã·ãŒã¯ã€ã¡ãŒãžããªããžããªã« push ãããã¿ã€ãã³ã°ã§è©äŸ¡ãããŸãã
ããã«ãããã³ã³ãã©ã€ã¢ã³ã¹ç¶æ³ã®è¿œè·¡ãéžè±ã®éç¥ãCI/CD ãã€ãã©ã€ã³ãžã®ãã§ãã¯çµ±åãå¯èœã«ãªããŸãã
äŸ: DHI ããŒã¹ã®ã€ã¡ãŒãžã«å¯Ÿããããªã·ãŒãäœæãã
ãã®äŸã§ã¯ãOrganization å ã®ãã¹ãŠã®ã€ã¡ãŒãžã Docker Hardened ImagesïŒDHIïŒãããŒã¹ã«äœ¿çšããããšãèŠæ±ããããªã·ãŒã®äœææé ã瀺ããŸãã
ããã«ããããã¹ãŠã®ã¢ããªã±ãŒã·ã§ã³ãã»ãã¥ã¢ã§ãããã«ãã€æ¬çªç°å¢ã«é©ããã€ã¡ãŒãžäžã§æ§ç¯ãããããšãä¿èšŒãããŸãã
ã¹ããã 1ïŒ Dockerfile ã§ DHI ãããŒã¹ã€ã¡ãŒãžãšããŠäœ¿çšãã
ãŸãããã©ãŒãªã³ã°æžã¿ã® DHI ãªããžããªãããŒã¹ãšããŠäœ¿çšãã Dockerfile ãäœæããŸãã
äŸ:
# Dockerfile
FROM ORG_NAME/dhi-python:3.13-alpine3.21
ENTRYPOINT ["python", "-c", "print('Hello from a DHI-based image')"]
ã¹ããã 2ïŒ ã€ã¡ãŒãžããã«ãããŠããã·ã¥ãã
ã¿ãŒããã«ãéããŠãDockerfile ããããã£ã¬ã¯ããªãžç§»åãã以äžã®ã³ãã³ãã§ã€ã¡ãŒãžããã«ãã㊠Docker Hub ã«ããã·ã¥ããŸã:
$ docker build \
--push \
-t YOUR_ORG/my-dhi-app:v1 .
ã¹ããã 3ïŒ Docker Scout ãæå¹åãã
以äžã®ã³ãã³ãã䜿ã£ãŠãDocker Scout ã Oranization ãšãªããžããªã«å¯ŸããŠæå¹åããŸã:
$ docker login
$ docker scout enroll YOUR_ORG
$ docker scout repo enable --org YOUR_ORG YOUR_ORG/my-dhi-app
ã¹ããã 4ïŒ ããªã·ãŒãäœæãã
-
Docker Scout ããã·ã¥ããŒãâ ã«ã¢ã¯ã»ã¹ããŸãã
-
Organization ãéžæããPolicies ã«ç§»åããŸãã
-
Add policy ãéžæããŸãã
-
Approved Base Images Policy ã® Configure ãéžæããŸãã
-
ããªã·ãŒã«ãApproved DHI Base Imagesããªã©ã®åãããããååãä»ããŸãã
-
Approved base image sources ã®ããã©ã«ãé ç®ãåé€ããŸãã
-
Approved base image sources ã«ãæ¿èªããã DHI ã®ããŒã¹ã€ã¡ãŒãžã远å ããŸãã
ãã®äŸã§ã¯ã¯ã€ã«ãã«ãŒã
docker.io/ORG_NAME/dhi-*
ã䜿ãããã¹ãŠã®ãã©ãŒãªã³ã°æžã¿ DHI ãèš±å¯ããŸãïŒORG_NAME 㯠Organization åã«çœ®ãæããŠãã ããïŒã -
Save policy ãéžæããŠä¿åããŸãã
ã¹ããã 5ïŒ ããªã·ãŒé©åæ§ãè©äŸ¡ãã
-
Docker Scout ããã·ã¥ããŒãâ ã«ã¢ã¯ã»ã¹ããŸãã
-
Organization ãéžæããImages ã«ç§»åããŸãã
-
YOUR_ORG/my-dhi-app:v1
ãæ¢ããCompliance åã®ãªã³ã¯ãã¯ãªãã¯ããŸãã
ããã§ã¯ãApproved DHI Base Images ããªã·ãŒã®èŠä»¶ãæºãããŠãããã©ãããªã©ãã€ã¡ãŒãžã®ããªã·ãŒé©åæ§ã®çµæã衚瀺ãããŸãã
CI ãã€ãã©ã€ã³å ã§ããªã·ãŒé©åæ§ãè©äŸ¡ããæ¹æ³ã«ã€ããŠã¯ãCI ã§ã®ããªã·ãŒè©äŸ¡ ãåç §ããŠãã ããã