1
# 查看所有 Capabilities
2
capsh --print
3

4
# 查看当前进程的 Capabilities
5
cat /proc/self/status | grep Cap
6
# CapInh: 0000000000000000
7
# CapPrm: 0000003fffffffff
8
# CapEff: 0000003fffffffff
9
# CapBnd: 0000003fffffffff
10
# CapAmb: 0000000000000000
11

12
# 解码 Capabilities
13
python3 -c "
14
caps = 0x3fffffffff
15
for i in range(40):
16
    if caps & (1 << i):
17
        print(f'CAP_{i}')
18
"

1
# 查看 Docker 容器的默认 Capabilities
2
docker run --rm alpine capsh --print | grep "Current:"
3

4
# Docker 默认授予的 Capabilities：
5
# CAP_AUDIT_WRITE, CAP_CHOWN, CAP_DAC_OVERRIDE,
6
# CAP_FOWNER, CAP_FSETID, CAP_KILL,
7
# CAP_MKNOD, CAP_NET_BIND_SERVICE, CAP_NET_RAW,
8
# CAP_SETGID, CAP_SETUID, CAP_SETFCAP,
9
# CAP_SETPCAP, CAP_SYS_CHROOT
10

11
# 添加/删除 Capabilities
12
docker run --cap-drop=ALL --cap-add=NET_BIND_SERVICE nginx
13
docker run --cap-add=SYS_ADMIN alpine  # 危险！

1
// runc 设置 Capabilities（简化）
2
func setupCapabilities(spec *specs.LinuxCapabilities) error {
3
    // 1. 清除所有 Capabilities
4
    if err := unix.Prctl(unix.PR_CAPBSET_DROP, 0, 0, 0, 0); err != nil {
5
        return err
6
    }
7

8
    // 2. 设置 Bounding set（上限）
9
    for _, cap := range spec.Bounding {
10
        if err := unix.Prctl(unix.PR_CAPBSET_READ, uintptr(cap), 0, 0, 0); err != nil {
11
            return err
12
        }
13
    }
14

15
    // 3. 设置 Effective set（当前生效）
16
    caps := &unix.CapUser{
17
        Header: unix.CapUserHeader{Version: unix.LINUX_CAPABILITY_VERSION_3},
18
        Data:   unix.CapUserData{},
19
    }
20
    for _, cap := range spec.Effective {
21
        caps.Data[cap/32].Effective |= 1 << (cap % 32)
22
    }
23

24
    if err := unix.Capset(caps.Header, caps.Data[:]); err != nil {
25
        return err
26
    }
27

28
    return nil
29
}

1
{
2
  "defaultAction": "SCMP_ACT_ERRNO",
3
  "architectures": ["SCMP_ARCH_X86_64"],
4
  "syscalls": [
5
    {
6
      "names": ["accept", "access", "arch_prctl", "bind", "brk", ...],
7
      "action": "SCMP_ACT_ALLOW"
8
    },
9
    {
10
      "names": ["keyctl", "add_key", "request_key"],
11
      "action": "SCMP_ACT_ERRNO"
12
    },
13
    {
14
      "names": ["mount"],
15
      "action": "SCMP_ACT_ERRNO",
16
      "args": []
17
    }
18
  ]
19
}

1
# 使用自定义 seccomp 配置
2
docker run --security-opt seccomp=/path/to/seccomp.json nginx
3

4
# 禁用 seccomp（危险！）
5
docker run --security-opt seccomp=unconfined nginx
6

7
# 使用 Docker 默认 seccomp 配置作为模板
8
wget https://raw.githubusercontent.com/moby/moby/master/profiles/seccomp/default.json

1
# 安装 seccomp-tools
2
gem install seccomp-tools
3

4
# 分析容器的系统调用
5
seccomp-tools dump -c "docker run alpine ls" | head -30
6

7
# 追踪特定系统调用
8
seccomp-tools trace -c "docker run alpine cat /etc/passwd"

1
# 查看 AppArmor 状态
2
sudo aa-status
3

4
# 查看容器使用的 AppArmor 配置
5
docker inspect mycontainer --format '{{.AppArmorProfile}}'
6

7
# Docker 默认使用 docker-default 配置

1
# 查看 docker-default 配置
2
sudo cat /etc/apparmor.d/docker-default
3

4
# 关键规则（简化）：
5
# deny /sys/[^f]/** wklx,        # 禁止写 /sys（除 /sys/fs）
6
# deny /sys/f[^s]/** wklx,       # 禁止写 /sys/f（除 /sys/fs/cgroup）
7
# deny /sys/fs/[^c]/** wklx,     # 禁止写 /sys/fs（除 /sys/fs/cgroup）
8
# owner /** rw,                   # 允许读写自己拥有的文件
9
# /proc/** r,                     # 允许读 /proc
10
# /dev/** rw,                     # 允许读写 /dev

1
# 创建自定义 AppArmor 配置
2
sudo cat > /etc/apparmor.d/mycontainer << 'EOF'
3
#include <tunables/global>
4

5
profile mycontainer flags=(attach_disconnected,mediate_deleted) {
6
  #include <abstractions/base>
7

8
  # 允许读 /etc
9
  /etc/** r,
10

11
  # 允许写 /tmp
12
  /tmp/** rw,
13

14
  # 禁止读 /etc/shadow
15
  deny /etc/shadow r,
16

17
  # 允许网络连接
18
  network inet tcp,
19
  network inet udp,
20

21
  # 允许信号
22
  signal (receive) peer=/usr/bin/docker,
23
}
24
EOF
25

26
# 加载配置
27
sudo apparmor_parser -r /etc/apparmor.d/mycontainer
28

29
# 使用自定义配置
30
docker run --security-opt apparmor=mycontainer nginx

1
# Podman 天然支持 rootless
2
podman run -d nginx
3

4
# 底层原理：
5
# 1. 创建 User Namespace
6
# 2. 配置 UID 映射：0 → 100000, 1 → 100001, ...
7
# 3. 在 User Namespace 内创建其他 Namespace
8
# 4. 使用 fuse-overlayfs 替代 OverlayFS（无需 root）
9
# 5. 使用 slirp4netns 或 pasta 替代 veth pair（无需 root）

1
# 安装 Docker rootless 模式
2
dockerd-rootless-setuptool.sh install
3

4
# 运行 rootless 容器
5
docker run -d nginx
6

7
# 限制：
8
# - 不能绑定特权端口（< 1024）
9
# - 网络性能较低（slirp4netns）
10
# - 不能使用 AppArmor
11
# - 不能修改 sysctl 参数

1
# Kubernetes Pod 安全上下文
2
apiVersion: v1
3
kind: Pod
4
spec:
5
  securityContext:
6
    runAsNonRoot: true
7
    runAsUser: 1000
8
    fsGroup: 2000
9
    seccompProfile:
10
      type: RuntimeDefault
11
  containers:
12
  - name: nginx
13
    securityContext:
14
      allowPrivilegeEscalation: false
15
      readOnlyRootFilesystem: true
16
      capabilities:
17
        drop: ["ALL"]
18
        add: ["NET_BIND_SERVICE"]
19
    resources:
20
      limits:
21
        memory: "512Mi"
22
        cpu: "1"

1
# 使用 Trivy 扫描镜像漏洞
2
trivy image nginx:latest
3

4
# 输出示例：
5
# nginx:latest (debian 12.4)
6
# ===========================
7
# Total: 42 (UNKNOWN: 0, LOW: 15, MEDIUM: 20, HIGH: 6, CRITICAL: 1)
8
# ┌──────────────┬────────────┬──────────┬───────────────────┐
9
# │   Library    │ Vulnerability│ Severity │ Installed Version │
10
# ├──────────────┼────────────┼──────────┼───────────────────┤
11
# │ libc-bin     │ CVE-2023-1234│ CRITICAL │ 2.36-9            │
12
# │ libssl3      │ CVE-2023-5678│ HIGH     │ 3.0.11            │
13
# └──────────────┴────────────┴──────────┴───────────────────┘

1
#!/bin/bash
2
# 容器安全审计脚本
3

4
CONTAINER=$1
5

6
echo "=== 容器安全审计: $CONTAINER ==="
7

8
echo ""
9
echo "1. 特权模式检查"
10
PRIVILEGED=$(docker inspect -f '{{.HostConfig.Privileged}}' $CONTAINER)
11
if [ "$PRIVILEGED" = "true" ]; then
12
    echo "  容器运行在特权模式！"
13
else
14
    echo "  容器未运行在特权模式"
15
fi
16

17
echo ""
18
echo "2. Capabilities 检查"
19
CAPS=$(docker inspect -f '{{.HostConfig.CapAdd}}' $CONTAINER)
20
echo "  添加的 Capabilities: $CAPS"
21
if echo "$CAPS" | grep -q "SYS_ADMIN"; then
22
    echo "    CAP_SYS_ADMIN 已添加，风险极高"
23
fi
24

25
echo ""
26
echo "3. seccomp 检查"
27
SECCOMP=$(docker inspect -f '{{.HostConfig.SecurityOpt}}' $CONTAINER)
28
if echo "$SECCOMP" | grep -q "unconfined"; then
29
    echo "  seccomp 已禁用！"
30
else
31
    echo "  seccomp 已启用"
32
fi
33

34
echo ""
35
echo "4. AppArmor 检查"
36
APPARMOR=$(docker inspect -f '{{.AppArmorProfile}}' $CONTAINER)
37
if [ "$APPARMOR" = "" ] || [ "$APPARMOR" = "unconfined" ]; then
38
    echo "    AppArmor 未配置"
39
else
40
    echo "  AppArmor: $APPARMOR"
41
fi
42

43
echo ""
44
echo "5. 资源限制检查"
45
MEM=$(docker inspect -f '{{.HostConfig.Memory}}' $CONTAINER)
46
CPU=$(docker inspect -f '{{.HostConfig.NanoCpus}}' $CONTAINER)
47
PIDS=$(docker inspect -f '{{.HostConfig.PidsLimit}}' $CONTAINER)
48
echo "  内存限制: $MEM"
49
echo "  CPU 限制: $CPU"
50
echo "  PID 限制: $PIDS"
51

52
echo ""
53
echo "6. 只读文件系统检查"
54
RO=$(docker inspect -f '{{.HostConfig.ReadonlyRootfs}}' $CONTAINER)
55
if [ "$RO" = "true" ]; then
56
    echo "  根文件系统为只读"
57
else
58
    echo "    根文件系统可写"
59
fi
60

61
echo ""
62
echo "7. 挂载检查"
63
MOUNTS=$(docker inspect -f '{{.Mounts}}' $CONTAINER)
64
echo "  挂载点: $MOUNTS"
65
if echo "$MOUNTS" | grep -q "/var/run/docker.sock"; then
66
    echo "  挂载了 Docker socket，可逃逸到宿主机！"
67
fi

1
# 启动一个默认配置的容器
2
docker run -d --name sec-demo alpine:latest sleep 300
3

4
# 查看容器进程的实际 Capabilities
5
CONTAINER_PID=$(docker inspect -f '{{.State.Pid}}' sec-demo)
6
cat /proc/$CONTAINER_PID/status | grep -i Cap

1
CapInh:  0000000000000000
2
CapPrm:  00000000a80425fb
3
CapEff:  00000000a80425fb
4
CapBnd:  00000000a80425fb
5
CapAmb:  0000000000000000

1
docker run --rm --cap-drop=ALL alpine:latest sh -c 'cat /proc/self/status | grep Cap'

1
CapInh:  0000000000000000
2
CapPrm:  0000000000000000
3
CapEff:  0000000000000000
4
CapBnd:  0000000000000000
5
CapAmb:  0000000000000000

1
docker run --rm --read-only alpine:latest sh -c \
2
  'echo "read-only fs works" && touch /tmp/test 2>&1 || echo "写入 /tmp 失败（预期行为）"'

1
read-only fs works
2
touch: /tmp/test: Read-only file system
3
写入 /tmp 失败（预期行为）

1
CONTAINER=sec-demo
2

3
echo "=== 容器安全基线检查 ==="
4
echo "1. 镜像: $(docker inspect -f '{{.Config.Image}}' $CONTAINER)"
5
echo "2. 运行用户: $(docker inspect -f '{{.Config.User}}' $CONTAINER || echo '(默认 root)')"
6
echo "3. 特权模式: $(docker inspect -f '{{.HostConfig.Privileged}}' $CONTAINER)"
7
echo "4. 只读根 FS: $(docker inspect -f '{{.HostConfig.ReadonlyRootfs}}' $CONTAINER)"
8
echo "5. CapAdd: $(docker inspect -f '{{.HostConfig.CapAdd}}' $CONTAINER)"
9
echo "6. CapDrop: $(docker inspect -f '{{.HostConfig.CapDrop}}' $CONTAINER)"
10
echo "7. SecurityOpt: $(docker inspect -f '{{.HostConfig.SecurityOpt}}' $CONTAINER)"