05 - Container Security - Image Scanning and Runtime Protection

# Install Trivy
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh

# Scan a Docker image
trivy image node:18-alpine

# Scan with severity filter
trivy image --severity CRITICAL,HIGH node:18-alpine

# Output in SARIF format for GitHub
trivy image --format sarif --output trivy-results.sarif myapp:latest

# Scan local filesystem
trivy fs --security-checks vuln,config .

# Scan with exit code for CI (fails if CRITICAL found)
trivy image --exit-code 1 --severity CRITICAL myapp:latest
      

# .github/workflows/container-security.yml
name: Container Security Scan
on:
  push:
    branches: [main]
  pull_request:

jobs:
  trivy-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build Docker image
        run: docker build -t myapp:${{ github.sha }} .

      - name: Trivy vulnerability scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: "myapp:${{ github.sha }}"
          format: "sarif"
          output: "trivy-results.sarif"
          severity: "CRITICAL,HIGH"
          exit-code: "1"

      - name: Upload SARIF to GitHub Security
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: "trivy-results.sarif"
      

# Install Grype
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh

# Scan an image
grype myapp:latest

# Scan with filter and JSON output
grype myapp:latest --only-fixed --output json > grype-results.json

# Scan with fail-on severity
grype myapp:latest --fail-on critical

# Generate SBOM with Syft and analyze with Grype
syft myapp:latest -o cyclonedx-json > sbom.json
grype sbom:sbom.json
      

# Stage 1: Build
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
RUN npm run build

# Stage 2: Production (minimal image)
FROM gcr.io/distroless/nodejs20-debian12
WORKDIR /app
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
EXPOSE 3000
USER nonroot
CMD ["dist/server.js"]
      

# 1. Use specific versions, never :latest
FROM node:20.11.0-alpine3.19

# 2. Create a non-root user
RUN addgroup -S appgroup && adduser -S appuser -G appgroup

# 3. Set WORKDIR
WORKDIR /app

# 4. Copy dependency files first (cache layer)
COPY package*.json ./
RUN npm ci --only=production && npm cache clean --force

# 5. Copy application code
COPY --chown=appuser:appgroup . .

# 6. Don't expose privileged ports
EXPOSE 8080

# 7. Use non-root user
USER appuser

# 8. Use HEALTHCHECK
HEALTHCHECK --interval=30s --timeout=3s \
  CMD wget --no-verbose --tries=1 --spider http://localhost:8080/health || exit 1

# 9. Use exec form for CMD
CMD ["node", "dist/server.js"]
      

# Install Cosign
brew install cosign  # macOS
# or
go install github.com/sigstore/cosign/v2/cmd/cosign@latest

# Generate a key pair
cosign generate-key-pair

# Sign an image
cosign sign --key cosign.key myregistry.com/myapp:v1.0.0

# Verify the signature
cosign verify --key cosign.pub myregistry.com/myapp:v1.0.0

# Sign with keyless (Sigstore/Fulcio)
cosign sign myregistry.com/myapp:v1.0.0
      

# Pod with restrictive security context
apiVersion: v1
kind: Pod
metadata:
  name: secure-app
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: app
      image: myapp:v1.0.0
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop:
            - ALL
      resources:
        limits:
          memory: "256Mi"
          cpu: "500m"
        requests:
          memory: "128Mi"
          cpu: "250m"
      

# Deny all ingress by default
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Ingress

---
# Allow only specific traffic
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-api
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: api
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: frontend
      ports:
        - protocol: TCP
          port: 8080