您当前的位置:首页 > 帮助中心 > 百度云开放云知识库 >

Docker安全设置教程之镜像安全设置

 

 
来自CoreOS的 Clair 实现了一个restful的服务,同样是周期性的同步各种漏洞源信息,然后客户端可以将镜像传给Clair,然后Clair解析出镜像里的软件包,如果软件包包含漏洞的话, Clair可以调webhook发送通知到外部服务。我的理解Clair并不是一个完备的解决方案,但是你可以很容易的将Clair集成到自己的工作流中去。可惜这个东西目前还比较小众,


安装配置
 
yum install epel-release && yum install -y python-pip rpm-python dpkg
pip install anchore
anchore feeds sync

实际操作

# 分析本地的镜像
anchore analyze --image ubuntu:latest --imagetype base
# 分析结果生成报告
anchore gate --image ubuntu:latest
报告中会显示哪个地方有漏洞,已经漏洞对应的链接。

准备sample配置文件
 
mkdir clair/clair_config/
curl -L https://raw.githubusercontent.com/coreos/clair/master/config.example.yaml -o clair/clair_config/config.yaml
修改数据库配置 vi clair/clair_config/config.yaml
 
source: host=postgres port=5432 user=postgres password=password sslmode=disable statement_timeout=60000
准备compose file
 
cd clair
curl -L https://raw.githubusercontent.com/coreos/clair/master/docker-compose.yml -o docker-compose.yml
启动
 
docker-compose up -d
 
 
刚才我也提到,Clair只是提供了api接口,所以使用起来并不是那么方便,我在Github上找到了clairctl这个客户端工具,可以方便的测试Clair的功能
 
安装clairctl
 
go get github.com/jgsqware/clairctl
cd ~/go/src/github.com/jgsqware/clairctl
go build
cp clairctl /usr/local/bin/
分析镜像
 
检查是否已经连接上Clair
 
~ clairctl health
 
Clair: ✔
将镜像上传到Clair
 
~ clairctl push -l mongo mongo:latest has been pushed to Clair
分析镜像中的漏洞
 
~ clairctl analyze mongo
 
Image: docker.io/mongo:latest
 11 layers found
 
  ➜ Analysis [sha256:bb0dc] found 36 vulnerabilities.
  ➜ Analysis [sha256:2369c] found 36 vulnerabilities.
  ➜ Analysis [sha256:ef2c7] found 36 vulnerabilities.
  ➜ Analysis [sha256:9504d] found 36 vulnerabilities.
  ➜ Analysis [sha256:7584b] found 34 vulnerabilities.
  ➜ Analysis [sha256:081d7] found 34 vulnerabilities.
  ➜ Analysis [sha256:b394c] found 34 vulnerabilities.
  ➜ Analysis [sha256:a647e] found 34 vulnerabilities.
  ➜ Analysis [sha256:90df9] found 34 vulnerabilities.
  ➜ Analysis [sha256:b03f9] found 34 vulnerabilities.
  ➜ Analysis [sha256:e45e8] found 34 vulnerabilities.
生成漏洞报告
 
~ clairctl report mongo
HTML report at reports/html/analysis-mongo-latest.html
其他
 
Open Source Solution
 
OpenSCAP/atomic scan
Commercial Solution


[2017-06-22 17:37:34]

在线咨询
售后咨询
扫一扫

扫一扫
凯铧科技

服务QQ
3287819116

返回顶部