– Auditing 15 Same Dockerfile Always Builds Same Image? • Base image ubuntu:latest could be changed between builds • ubuntu:14.04 could also be changed due to patching • apt-get (curl, wget..) cannot the same packages • ADD depends on the build time environment to add files 16 Example: FROM ubuntu RUN apt-get install –y python ADD app.jar /myapp/app.jar Shipping Images in Binary Format for Based Access Control in Harbor 20 Project Members Images Guest: Developer: Admin: ${Project}/ubuntu:14.04 ${Project}/nginx:1.8, 1.9 ${Project}/golang:1.6.2 ${Project}/redis:3.0 …... docker pull

Registry – 镜像管理的重要部件 • 基础镜像 ubuntu:latest 可能在不同构建时间会有差别 • 即使 ubuntu:14.04 也可能会有改变（补丁不同） • apt-get (curl, wget..) 无法保证安装同样的软件包 • ADD 依赖构建时候的文件 5 例子: FROM ubuntu RUN apt-get install –y python 基于角色的访问控制 18 项目 Project 成员 Members 镜像 Images Guest: Developer: Admin: ${Project}/ubuntu:14.04 ${Project}/nginx:1.8, 1.9 ${Project}/golang:1.6.2 ${Project}/redis:3.0 …... docker Controller 镜像漏洞扫描 • 漏洞扫描是对镜像的文件做静态分析 (Clair) • 漏洞数据来源 - Debian Security Bug Tracker - Ubuntu CVE Tracker - Red Hat Security Data - Oracle Linux Security Data - Alpine SecDB 控制策略

Robustness / High Availability 15 Deterministic Images? • Base image ubuntu:latest could be changed between builds • ubuntu:14.04 could also be changed due to patching • apt-get (curl, wget..) does guarantee identical packages • ADD depends on the build time environment to add files 16 FROM ubuntu RUN apt-get install –y python ADD app.jar /myapp/app.jar Dockerfile Challenges Image replication Scanning 26 Update vulnerability data regularly from various sources: – Debian security Bug Tracker – Ubuntu CVE Tracker – Red Hat Security Data – Oracle Linux Security Data – Alpine SecDB – NIST Image Vulnerability

���������� • �������� § �� § �� § �� • ��������� • �������� § Debian Security Bug Tracker § Ubuntu CVE Tracker § Red Hat Security Data § Oracle Linux Security Data § Alpine SecDB API Registry ���������� • �������� § �� § �� § �� • ��������� • �������� § Debian Security Bug Tracker § Ubuntu CVE Tracker § Red Hat Security Data § Oracle Linux Security Data § Alpine SecDB 20 Confidential

���������� • �������� § �� § �� § �� • ��������� • �������� § Debian Security Bug Tracker § Ubuntu CVE Tracker § Red Hat Security Data § Oracle Linux Security Data § Alpine SecDB API Registry ���������� • �������� § �� § �� § �� • ��������� • �������� § Debian Security Bug Tracker § Ubuntu CVE Tracker § Red Hat Security Data § Oracle Linux Security Data § Alpine SecDB 20 Confidential

eXperience(DX) + Union File System Docker by dotCloud at 2013 After 4 years docker run ubuntu “echo hello” Solaris container by Sun at 2005 build, ship and run any app and anywhere • External MySQL cluster • Share sessions in Redis Environment & Prerequisites • 三台VM(Ubuntu 16.04及以上版本)； • CephFS、MySQL、Redis已就绪； • Harbor v1.1.0及以上版本； • 一个域名：hub.tonybai.com:8070 Step1: