云原生利器 dockle 检查 docker
优质文章，每日送达
「【只做懂你de云原生干货知识共享】」
云原生利器 dockle 检查 docker
作为 SRE，我一直在寻找可以帮助我更好地完成工作的工具。Kubernetes 生态系统充满了令人惊叹的工具，尤其是可以验证您的集群和容器镜像是否以可靠和安全的方式配置的工具。其中一种工具是dockle。如果您还没有听说过，那么 dockle 是一种容器扫描工具，可用于验证您的容器是否符合最佳实践。
dockle: https://github.com/goodwithtech/dockle
最佳实践：https://github.com/goodwithtech/dockle/blob/master/CHECKPOINT.md
同样支持多个操作系统使用此命令行https://github.com/goodwithtech/dockle要开始使用 dockle，您可以将存储库的名称和可选标签作为参数传递：
🐳 ➜ ~ ./dockle golang:latest
2021-09-09T12:59:30.733+0800 INFO Failed to check latest version. not found version patterns
WARN - CIS-DI-0001: Create a user for the container
* Last user should not be root
WARN - DKL-DI-0006: Avoid latest tag
* Avoid 'latest' tag
INFO - CIS-DI-0005: Enable Content trust for Docker
* export DOCKER_CONTENT_TRUST=1 before docker pull/build
INFO - CIS-DI-0006: Add HEALTHCHECK instruction to the container image
* not found HEALTHCHECK statement
INFO - CIS-DI-0008: Confirm safety of setuid/setgid files
* setuid file: urwxr-xr-x usr/bin/chsh
* setgid file: grwxr-xr-x usr/bin/chage
* setuid file: urwxr-xr-x bin/mount
* setgid file: grwxr-xr-x usr/bin/wall
* setuid file: urwxr-xr-x usr/bin/passwd
* setuid file: urwxr-xr-x usr/bin/gpasswd
* setuid file: urwxr-xr-x usr/bin/chfn
* setgid file: grwxr-xr-x usr/bin/expiry
* setgid file: grwxr-xr-x usr/bin/ssh-agent
* setgid file: grwxr-xr-x sbin/unix_chkpwd
* setuid file: urwxr-xr-x bin/umount
* setuid file: urwxr-xr-x usr/lib/openssh/ssh-keysign
* setuid file: urwxr-xr-x bin/su
* setuid file: urwxr-xr-x usr/bin/newgrp
INFO - DKL-LI-0003: Only put necessary files
* unnecessary file : usr/local/go/src/crypto/elliptic/internal/fiat/Dockerfile
然后，Dockle 将检查容器镜像并提供有关 STDOUT 的反馈。输出包含触发输出的检查点，以及如果找到会发生什么的描述。
这个项目同样的github目前拥有1.6k的star,这个项目同样对一些镜像扫描的产品做出的对比
扫描镜像文件
🐳 ➜ ~ $ docker save alpine:latest -o alpine.tar
🐳 ➜ ~ $ dockle --input alpine.tar
获取或保存结果为 JSON
🐳 ➜ ~ $ dockle -f json goodwithtech/test-image:v1
$ dockle -f json -o results.json goodwithtech/test-image:v1
{
"summary": {
"fatal": 6,
"warn": 2,
"info": 2,
"pass": 7
},
"details": [
{
"code": "CIS-DI-0001",
"title": "Create a user for the container",
"level": "WARN",
"alerts": [
"Last user should not be root"
]
},
{
"code": "CIS-DI-0005",
"title": "Enable Content trust for Docker",
"level": "INFO",
"alerts": [
"export DOCKER_CONTENT_TRUST=1 before docker pull/build"
]
},
{
"code": "CIS-DI-0006",
"title": "Add HEALTHCHECK instruction to the container image",
"level": "WARN",
"alerts": [
"not found HEALTHCHECK statement"
]
},
{
"code": "CIS-DI-0008",
"title": "Remove setuid and setgid permissions in the images",
"level": "INFO",
"alerts": [
"Found setuid file: usr/lib/openssh/ssh-keysign urwxr-xr-x"
]
},
{
"code": "CIS-DI-0009",
"title": "Use COPY instead of ADD in Dockerfile",
"level": "FATAL",
"alerts": [
"Use COPY : /bin/sh -c #(nop) ADD file:81c0a803075715d1a6b4f75a29f8a01b21cc170cfc1bff6702317d1be2fe71a3 in /app/credentials.json "
]
},
{
"code": "CIS-DI-0010",
"title": "Do not store secrets in ENVIRONMENT variables",
"level": "FATAL",
"alerts": [
"Suspicious ENV key found : MYSQL_PASSWD"
]
},
{
"code": "CIS-DI-0010",
"title": "Do not store secret files",
"level": "FATAL",
"alerts": [
"Suspicious filename found : app/credentials.json "
]
},
{
"code": "DKL-DI-0002",
"title": "Avoid sensitive directory mounting",
"level": "FATAL",
"alerts": [
"Avoid mounting sensitive dirs : /usr"
]
},
{
"code": "DKL-DI-0005",
"title": "Clear apt-get caches",
"level": "FATAL",
"alerts": [
"Use 'rm -rf /var/lib/apt/lists' after 'apt-get install' : /bin/sh -c apt-get update \u0026\u0026 apt-get install -y git"
]
},
{
"code": "DKL-LI-0001",
"title": "Avoid empty password",
"level": "FATAL",
"alerts": [
"No password user found! username : nopasswd"
]
}
]
}
获取或保存结果为 SARIF
$ dockle -f sarif goodwithtech/test-image:v1
$ dockle -f sarif -o results.json goodwithtech/test-image:v1
``` { "version": "2.1.0", "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json", "runs": [ { "tool": { "driver": { "name": "Dockle", "informationUri": "https://github.com/goodwithtech/dockle", "rules": [ { "id": "CIS-DI-0009", "shortDescription": { "text": "Use COPY instead of ADD in Dockerfile" }, "help": { "text": "https://github.com/goodwithtech/dockle/blob/master/CHECKPOINT.md#CIS-DI-0009" } }, { "id": "CIS-DI-0010", "shortDescription": { "text": "Do not store credential in ENVIRONMENT vars/files" }, "help": { "text": "https://github.com/goodwithtech/dockle/blob/master/CHECKPOINT.md#CIS-DI-0010" } }, { "id": "DKL-DI-0005", "shortDescription": { "text": "Clear apt-get caches" }, "help": { "text": "https://github.com/goodwithtech/dockle/blob/master/CHECKPOINT.md#DKL-DI-0005" } }, { "id": "DKL-LI-0001", "shortDescription": { "text": "Avoid empty password" }, "help": { "text": "https://github.com/goodwithtech/dockle/blob/master/CHECKPOINT.md#DKL-LI-0001" } }, { "id": "CIS-DI-0005", "shortDescription": { "text": "Enable Content trust for Docker" }, "help": { "text": "https://github.com/goodwithtech/dockle/blob/master/CHECKPOINT.md#CIS-DI-0005" } }, { "id": "CIS-DI-0008", "shortDescription": { "text": "Confirm safety of setuid/setgid files" }, "help": { "text": "https://github.com/goodwithtech/dockle/blob/master/CHECKPOINT.md#CIS-DI-0008" } }, { "id": "CIS-DI-0001", "shortDescription": { "text": "Create a user for the container" }, "help": { "text": "https://github.com/goodwithtech/dockle/blob/master/CHECKPOINT.md#CIS-DI-0001" } }, { "id": "CIS-DI-0006", "shortDescription": { "text": "Add HEALTHCHECK instruction to the container image" }, "help": { "text": "https://github.com/goodwithtech/dockle/blob/master/CHECKPOINT.md#CIS-DI-0006" } } ] } }, "results": [ { "ruleId": "CIS-DI-0009", "level": "error", "message": { "text": "Use COPY : /bin/sh -c #(nop) ADD file:81c0a803075715d1a6b4f75a29f8a01b21cc170cfc1bff6702317d1be2fe71a3 in /app/credentials.json " } }, { "ruleId": "CIS-DI-0010", "level": "error", "message": { "text": "Suspicious filename found : app/credentials.json , Suspicious ENV key found : MYSQL_PASSWD" } }, { "ruleId": "DKL-DI-0005", "level": "error", "message": { "text": "Use 'rm -rf /var/lib/apt/lists' after 'apt-get install' : /bin/sh -c apt-get update \u0026\u0026 apt-get install -y git" } }, { "ruleId": "DKL-LI-0001", "level": "error", "message": { "text": "No password user found! username : nopasswd" } }, { "ruleId": "CIS-DI-0005", "level": "note", "message": { "text": "export DOCKER_CONTENT_TRUST=1 before docker pull/build" } }, { "ruleId": "CIS-DI-0008", "level": "note", "message": { "text": "setuid file: urwxr-xr-x usr/bin/newgrp, setgid file: grwxr-xr-x usr/bin/ssh-agent, setgid file: grwxr-xr-x usr/bin/expiry, setuid file: urwxr-xr-x usr/lib/openssh/ssh-keysign, setuid file: urwxr-xr-x bin/umount, setgid file: grwxr-xr-x usr/bin/chage, setuid file: urwxr-xr-x usr/bin/passwd, setgid file: grwxr-xr-x sbin/unix_chkpwd, setuid file: urwxr-xr-x usr/bin/chsh, setgid file: grwxr-xr-x usr/bin/wall, setuid file: urwxr-xr-x bin/ping, setuid file: urwxr-xr-x bin/su, setuid file: urwxr-xr-x usr/bin/chfn, setuid file: urwxr-xr-x usr/bin/gpasswd, setuid file: urwxr-xr-x bin/mount" } }, { "ruleId": "CIS-DI-0001", "level": "none", "message": { "text": "Last user should not be root" } }, { "ruleId": "CIS-DI-0006", "level": "none", "message": { "text": "not found HEALTHCHECK statement" } } ] } ] } ``
我真的很喜欢简洁的输出，以及忽略警告和控制产生的退出代码的能力。将它添加到 CI/CD 管道很容易，并且是对容器扫描工具（如Clair和Trivy）的一个很好的补充。超级酷的项目！
参考
https://github.com/goodwithtech/dockle https://www.cisecurity.org/benchmark/docker/