34 lines
1.6 KiB
Markdown
34 lines
1.6 KiB
Markdown
|
# 6.1 — Hardened container image (GREEN)
|
||
|
|
|
||
|
|
Phase: 6 — Deploy and cutover
|
||
|
|
Stage: GREEN
|
||
|
|
|
||
|
|
The gateway is the public edge process. It gets no shell, no package manager, no
|
||
|
|
writable filesystem and no privileges it does not need.
|
||
|
|
|
||
|
|
- [ ] The runtime image is distroless or scratch — no shell, no package manager, no busybox
|
||
|
|
- [ ] The container runs as a non-root user, enforced by `runAsNonRoot` and an explicit non-zero UID
|
||
|
|
- [ ] The root filesystem is read-only; any writable path the process genuinely needs is an explicitly mounted volume, not a relaxed rootfs
|
||
|
|
- [ ] All Linux capabilities are dropped, and none are added back
|
||
|
|
- [ ] `seccompProfile` is `RuntimeDefault`
|
||
|
|
- [ ] Privilege escalation is disabled
|
||
|
|
- [ ] Image tags are the commit SHA of the source that built them. Never `:latest`, never a moving tag — Argo `selfHeal` cannot reconcile a mutable tag reliably, and a rollback needs a tag that still means what it meant yesterday
|
||
|
|
- [ ] The image is reproducible from a committed build definition; nothing is built by hand
|
||
|
|
- [ ] The image contains no credentials, kubeconfig or service-account token baked in (G2)
|
||
|
|
|
||
|
|
## Verify
|
||
|
|
|
||
|
|
```bash
|
||
|
|
docker run --rm --entrypoint sh <image>:<sha>
|
||
|
|
# expected: fails — no shell in the image
|
||
|
|
|
||
|
|
docker run --rm --read-only --user 65532 <image>:<sha> --version
|
||
|
|
# expected: starts and exits cleanly under a read-only rootfs as a non-root user
|
||
|
|
|
||
|
|
docker inspect <image>:<sha> --format '{{.Config.User}}'
|
||
|
|
# expected: a non-zero numeric UID, not empty and not "root"
|
||
|
|
|
||
|
|
grep -rn 'image:' k8s/ | grep -v '@sha256\|:[0-9a-f]\{7,\}'
|
||
|
|
# expected: no matches — every image reference is pinned to a SHA
|
||
|
|
```
|