漏洞数据来源 - Debian Security Bug Tracker - Ubuntu CVE Tracker - Red Hat Security Data - Oracle Linux Security Data - Alpine SecDB 控制策略 21 • 设置自动扫描：上传即扫描 • 设置漏洞级别阈值；超过阈值的镜像 无法下载 • 设置内容信任 27 虚拟容器主机 Docker 容器主机 部署/调度 物理基础架构 C Docker 引擎 Linux 内核 C C Linux 内 核 C Linux 内 核 C Linux 内 核 C Linux 内 核 C C 管理/镜像Registry 安全性 VIC 服务引擎 存储虚拟化 计算虚拟化 网络虚拟化

in one of the following ways: • Follow the steps in the Ingress CA section. • Run the following command on the tenant cluster where Harbor registry is installed. kubectl get secrets -n ccp ccp-ingress-default-cert randomly generated by the Harbor operator and stored in a Kubernetes secret. Run the following command on the master node of the tenant cluster to get the admin password of the Harbor registry from the follow these steps: a) To push a helm chart to the Chartmuseum helm repository: Run the following command on the tenant cluster from where you want to upload the helm chart. Harbor Registry 2 Harbor Registry

�������� § Debian Security Bug Tracker § Ubuntu CVE Tracker § Red Hat Security Data § Oracle Linux Security Data § Alpine SecDB API Registry V2 Job Service Console DB Harbor Save Data Pull �������� § Debian Security Bug Tracker § Ubuntu CVE Tracker § Red Hat Security Data § Oracle Linux Security Data § Alpine SecDB 20 Confidential � ©2018 VMware, Inc. Replication Policy DISTRIBUTION

�������� § Debian Security Bug Tracker § Ubuntu CVE Tracker § Red Hat Security Data § Oracle Linux Security Data § Alpine SecDB API Registry V2 Job Service Console DB Harbor Save Data Pull �������� § Debian Security Bug Tracker § Ubuntu CVE Tracker § Red Hat Security Data § Oracle Linux Security Data § Alpine SecDB 20 Confidential � ©2018 VMware, Inc. Replication Policy DISTRIBUTION

GopherChina lecturer • Blogger • mainly focus on docker & kubernetes recently 五年前 Now Linux container(LXC) by Google at 2008 namespaces Cgroups + Developer eXperience(DX) + Union File

various sources: – Debian security Bug Tracker – Ubuntu CVE Tracker – Red Hat Security Data – Oracle Linux Security Data – Alpine SecDB – NIST Image Vulnerability Scanning Web interface and vulnerability

regularly - Debian Security Bug Tracker - Ubuntu CVE Tracker - Red Hat Security Data - Oracle Linux Security Data - Alpine SecDB 24 Vulnerability scanning Set vulnerability threshold Prevent images

-y yum-utils 步骤 2 设置 docker yum 源。 # yum-config-manager --add-repo https://download.docker.com/linux/centos/docker- ce.repo 步骤 3 查看可安装的版本 yum 源有时候会更新，请根据实际情况选择具体的版本安装 yum list docker-ce --showduplicates