Cloud Expert

Container Security — Build to Runtime¶

KontejnerySecuritySupply ChainRuntime 5 min čtení

Image hardening, supply chain, runtime protection a scanning.

Build-time¶

FROM node:20-slim AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
RUN npm run build

FROM gcr.io/distroless/nodejs20-debian12
COPY --from=builder /app/dist /app
USER nonroot:nonroot
CMD ["server.js"]

Supply Chain¶

# Cosign signing
cosign sign --key cosign.key myregistry/myapp:v1.2.3

# Kyverno verification policy
spec:
  rules:
    - verifyImages:
        - imageReferences: ["myregistry/*"]

Runtime¶

• Falco — syscall monitoring
• Seccomp profiles
• Read-only filesystem
• Resource limits

Shrnutí¶

Container security = distroless + signed supply chain + admission policies + runtime monitoring.

Potřebujete pomoct s implementací?¶

Náš tým má zkušenosti s návrhem a implementací moderních architektur. Rádi vám pomůžeme.

Nezávazná konzultace