05 - Container Security - Image Scanning e Runtime Protection

# Installare Trivy
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh

# Scan di un'immagine Docker
trivy image node:18-alpine

# Scan con filtro severita
trivy image --severity CRITICAL,HIGH node:18-alpine

# Output in formato SARIF per GitHub
trivy image --format sarif --output trivy-results.sarif myapp:latest

# Scan del filesystem locale
trivy fs --security-checks vuln,config .

# Scan con exit code per CI (fallisce se trova CRITICAL)
trivy image --exit-code 1 --severity CRITICAL myapp:latest
      

# .github/workflows/container-security.yml
name: Container Security Scan
on:
  push:
    branches: [main]
  pull_request:

jobs:
  trivy-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build Docker image
        run: docker build -t myapp:${{ github.sha }} .

      - name: Trivy vulnerability scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: "myapp:${{ github.sha }}"
          format: "sarif"
          output: "trivy-results.sarif"
          severity: "CRITICAL,HIGH"
          exit-code: "1"

      - name: Upload SARIF to GitHub Security
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: "trivy-results.sarif"
      

# Installare Grype
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh

# Scan di un'immagine
grype myapp:latest

# Scan con filtro e output JSON
grype myapp:latest --only-fixed --output json > grype-results.json

# Scan con fail-on severity
grype myapp:latest --fail-on critical

# Generare SBOM con Syft e analizzare con Grype
syft myapp:latest -o cyclonedx-json > sbom.json
grype sbom:sbom.json
      

# Stage 1: Build
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
RUN npm run build

# Stage 2: Production (immagine minimale)
FROM gcr.io/distroless/nodejs20-debian12
WORKDIR /app
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
EXPOSE 3000
USER nonroot
CMD ["dist/server.js"]
      

# 1. Usare versioni specifiche, mai :latest
FROM node:20.11.0-alpine3.19

# 2. Creare un utente non-root
RUN addgroup -S appgroup && adduser -S appuser -G appgroup

# 3. Impostare WORKDIR
WORKDIR /app

# 4. Copiare prima i file di dipendenze (cache layer)
COPY package*.json ./
RUN npm ci --only=production && npm cache clean --force

# 5. Copiare il codice applicativo
COPY --chown=appuser:appgroup . .

# 6. Non esporre porte privilegiate
EXPOSE 8080

# 7. Usare l'utente non-root
USER appuser

# 8. Usare HEALTHCHECK
HEALTHCHECK --interval=30s --timeout=3s \
  CMD wget --no-verbose --tries=1 --spider http://localhost:8080/health || exit 1

# 9. Usare exec form per CMD
CMD ["node", "dist/server.js"]
      

# Installare Cosign
brew install cosign  # macOS
# oppure
go install github.com/sigstore/cosign/v2/cmd/cosign@latest

# Generare una coppia di chiavi
cosign generate-key-pair

# Firmare un'immagine
cosign sign --key cosign.key myregistry.com/myapp:v1.0.0

# Verificare la firma
cosign verify --key cosign.pub myregistry.com/myapp:v1.0.0

# Firmare con keyless (Sigstore/Fulcio)
cosign sign myregistry.com/myapp:v1.0.0
      

# Pod con security context restrittivo
apiVersion: v1
kind: Pod
metadata:
  name: secure-app
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: app
      image: myapp:v1.0.0
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop:
            - ALL
      resources:
        limits:
          memory: "256Mi"
          cpu: "500m"
        requests:
          memory: "128Mi"
          cpu: "250m"
      

# Deny all ingress by default
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Ingress

---
# Allow only specific traffic
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-api
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: api
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: frontend
      ports:
        - protocol: TCP
          port: 8080