📋 Daftar Isi
1. Pengenalan Container Security
Container Security mencakup praktik, tools, dan kebijakan untuk melindungi containerized applications sepanjang lifecycle — dari build, deploy, hingga runtime. Container membawa tantangan keamanan unik karena sharing kernel, ephemeral nature, dan jumlah yang sangat banyak.
📋 Container Security Lifecycle
- Build — Secure Dockerfile, base image, dependency scanning
- Ship — Image signing, registry security, vulnerability scanning
- Run — Runtime policies, network segmentation, resource limits
- Monitor — Audit logging, anomaly detection, compliance
Container Attack Vectors
Diagram: Container Attack Surface
┌─────────────────────────────────────────────────────┐ │ CONTAINER ATTACK SURFACE │ │ │ │ ┌──────────┐ ┌──────────┐ ┌──────────┐ │ │ │ Supply │ │ Container│ │ Host │ │ │ │ Chain │ │ Runtime │ │ Escape │ │ │ │ │ │ │ │ │ │ │ │ • Malware│ │ • RCE │ │ • Kernel │ │ │ │ in img │ │ • Crypto │ │ exploit │ │ │ │ • Backdor│ │ mining │ │ • Mount │ │ │ └──────────┘ └──────────┘ └──────────┘ │ │ │ │ ┌──────────┐ ┌──────────┐ ┌──────────┐ │ │ │ Orchest- │ │ Network │ │ Secrets │ │ │ │ ration │ │ │ │ Exposure │ │ │ │ • RBAC │ │ • Lateral│ │ • Env var │ │ │ │ bypass │ │ move │ │ • Config │ │ │ └──────────┘ └──────────┘ └──────────┘ │ └─────────────────────────────────────────────────────┘
2. Dockerfile Security
Dockerfile adalah fondasi keamanan container. Kesalahan pada Dockerfile dapat menghasilkan image yang rentan.
Dockerfile — Secure Best Practices
# ============================================= +# Secure Dockerfile — Best Practices +# ============================================= +# 1. Specific base image tag (bukan latest) +FROM python:3.12-slim-bookworm AS builder +# 2. Non-root user +RUN groupadd -r appuser && useradd -r -g appuser appuser +# 3. Pin dependency versions +COPY requirements.txt . +RUN pip install --no-cache-dir -r requirements.txt +# 4. Multi-stage build +FROM python:3.12-slim-bookworm +COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages +# 5. Copy only necessary files +COPY --chown=appuser:appuser ./app /app +WORKDIR /app +# 6. Remove unnecessary packages +RUN apt-get remove -y gcc g++ && \ + apt-get autoremove -y && \ + rm -rf /var/lib/apt/lists/* +# 7. Non-root user +USER appuser +EXPOSE 8080 +HEALTHCHECK --interval=30s --timeout=3s \ + CMD curl -f http://localhost:8080/health || exit 1 +CMD ["python", "main.py"] +# YANG HARUS DIHINDARI: +# ❌ ENV DB_PASSWORD=secret123 +# ❌ COPY . . (termasuk .git, secrets) +# ❌ USER root atau tanpa USER directive +# ❌ CMD python main.py (shell form)
3. Image Scanning
Image scanning mengidentifikasi CVE dalam base image dan dependencies. Harus dilakukan di setiap stage: development, CI/CD, registry, dan runtime.
Bash — Container Image Scanning
# ============================================= +# Container Image Scanning +# ============================================= +# 1. Trivy — Scanner dari Aqua Security +trivy image myapp:latest +trivy image --severity HIGH,CRITICAL myapp:latest +trivy image --format json -o results.json myapp:latest +# 2. Scan Dockerfile misconfigurations +trivy config Dockerfile +trivy config --severity HIGH,CRITICAL ./k8s-manifests/ +# 3. Grype dari Anchore +grype myapp:latest +# 4. Docker Scout (built-in) +docker scout cves myapp:latest +# 5. Scan SBOM +trivy sbom --format spdx-json myapp:latest > sbom.json +syft myapp:latest -o spdx-json > sbom.json +# 6. CI/CD Pipeline integration +# aquasecurity/trivy-action di GitHub Actions +# dengan exit-code: '1' untuk fail on critical
4. Runtime Security
Runtime security melindungi container saat berjalan — resource limits, filesystem protection, syscall filtering, behavioral monitoring.
Bash — Docker Runtime Security
# ============================================= +# Docker Runtime Security Configuration +# ============================================= +# 1. Read-only filesystem +docker run --read-only --tmpfs /tmp myapp:latest +# 2. Drop all capabilities, add only needed +docker run --cap-drop ALL \ + --cap-add NET_BIND_SERVICE myapp:latest +# 3. No new privileges +docker run --security-opt no-new-privileges myapp:latest +# 4. Resource limits +docker run --memory=512m --cpus=0.5 \ + --pids-limit=100 myapp:latest +# 5. Seccomp profile +docker run --security-opt seccomp=custom.json myapp:latest +# 6. AppArmor profile +docker run --security-opt apparmor=docker-custom myapp:latest +# 7. Falco runtime monitoring +helm install falco falcosecurity/falco
5. Kubernetes Security
Kubernetes menambahkan layer keamanan orkestrasi: RBAC, network policies, pod security standards, admission controllers.
YAML — K8s Security Manifests
# =============================================
+# Kubernetes Security Best Practices
+# =============================================
+# Restricted Pod Security
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: secure-app
+spec:
+ template:
+ spec:
+ securityContext:
+ runAsNonRoot: true
+ runAsUser: 1000
+ seccompProfile:
+ type: RuntimeDefault
+ containers:
+ - name: app
+ image: myapp:v1.2.3
+ securityContext:
+ allowPrivilegeEscalation: false
+ readOnlyRootFilesystem: true
+ capabilities:
+ drop: ["ALL"]
+ resources:
+ limits:
+ memory: "256Mi"
+ cpu: "500m"
+ requests:
+ memory: "128Mi"
+ cpu: "250m"
+# Network Policy — Zero Trust
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+ name: default-deny-all
+spec:
+ podSelector: {}
+ policyTypes:
+ - Ingress
+ - Egress
+# RBAC — Least Privilege
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+ name: app-reader
+rules:
+ - apiGroups: [""]
+ resources: ["pods", "services"]
+ verbs: ["get", "list", "watch"]
6. Container Network Security
Network segmentation mencegah lateral movement. Gunakan network policy, service mesh, dan mTLS.
YAML — Istio mTLS
# Istio mTLS — Enforce encrypted communication +apiVersion: security.istio.io/v1beta1 +kind: PeerAuthentication +metadata: + name: default + namespace: production +spec: + mtls: + mode: STRICT +# Authorization policy +apiVersion: security.istio.io/v1beta1 +kind: AuthorizationPolicy +metadata: + name: frontend-to-backend +spec: + selector: + matchLabels: + app: backend + rules: + - from: + - source: + principals: ["cluster.local/ns/production/sa/frontend"] + to: + - operation: + methods: ["GET", "POST"] + paths: ["/api/*"]
7. Secrets Management
Jangan menyimpan secrets dalam code, env vars plain text, atau ConfigMap. Gunakan external secrets manager.
YAML — External Secrets
# External Secrets Operator — Vault Integration +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: app-secrets +spec: + refreshInterval: 1h + secretStoreRef: + name: vault-backend + kind: SecretStore + target: + name: app-secrets + creationPolicy: Owner + data: + - secretKey: db-password + remoteRef: + key: secret/data/myapp + property: db_password
8. Compliance & Audit
Bash — Docker CIS Benchmark
# Docker CIS Benchmark Audit +docker run --rm --net host --pid host \ + -v /var/run/docker.sock:/var/run/docker.sock \ + docker/docker-bench-security +# Kubernetes CIS +kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml +# Trivy compliance +trivy k8s --compliance=cis cluster +trivy k8s --compliance=nsa cluster
Supply Chain Security
Supply chain attacks pada container ecosystem terjadi ketika komponen yang dipercaya (base image, dependency, registry) dikompromikan. SolarWinds dan Codecov adalah contoh supply chain attacks besar.
Diagram: Container Supply Chain
┌─────────────────────────────────────────────────────┐ │ CONTAINER SUPPLY CHAIN │ │ │ │ ┌──────────┐ ┌──────────┐ ┌──────────┐ │ │ │ Base │ │ Package │ │ App │ │ │ │ Image │───▶│ Manager │───▶│ Code │ │ │ │ (OS) │ │ (pip/npm)│ │ │ │ │ └──────────┘ └──────────┘ └──────────┘ │ │ │ │ │ │ │ ▼ ▼ ▼ │ │ ┌──────────────────────────────────────────┐ │ │ │ Dockerfile │ │ │ │ (Build instructions) │ │ │ └──────────────────────┬───────────────────┘ │ │ ▼ │ │ ┌──────────────────────────────────────────┐ │ │ │ Container Image │ │ │ │ ┌──────┐ ┌──────┐ ┌──────┐ │ │ │ │ │Layer1│ │Layer2│ │Layer3│ ... │ │ │ │ │(OS) │ │(deps)│ │(app) │ │ │ │ │ └──────┘ └──────┘ └──────┘ │ │ │ └──────────────────────┬───────────────────┘ │ │ ▼ │ │ ┌──────────────────────────────────────────┐ │ │ │ Container Registry │ │ │ │ (DockerHub, ECR, GCR, Harbor) │ │ │ └──────────────────────────────────────────┘ │ │ │ │ ⚠️ ATTACK POINTS: │ │ • Poisoned base image │ │ • Malicious dependency (typosquatting) │ │ • Compromised build pipeline │ │ • Registry tampering │ │ • Signed image bypass │ └─────────────────────────────────────────────────────┘
Image Signing with Cosign
Bash — Container Image Signing
# ============================================= +# Container Image Signing & Verification +# ============================================= +# 1. Install cosign (Sigstore) +go install github.com/sigstore/cosign/v2/cmd/cosign@latest +# 2. Generate keypair +cosign generate-key-pair +# 3. Sign image +cosign sign --key cosign.key registry.example.com/myapp:v1.0 +# 4. Verify signature +cosign verify --key cosign.pub registry.example.com/myapp:v1.0 +# 5. Sign with keyless (OIDC identity) +cosign sign registry.example.com/myapp:v1.0 +# Uses Fulcio for short-lived certificates +# Uses Rekor for transparency log +# 6. Enforce signature verification in K8s +# Kyverno policy: +apiVersion: kyverno.io/v1 +kind: ClusterPolicy +metadata: + name: verify-image-signatures +spec: + validationFailureAction: enforce + rules: + - name: verify-cosign-signature + match: + resources: + kinds: ["Pod"] + verifyImages: + - imageReferences: ["registry.example.com/*"] + attestors: + - entries: + - keys: + publicKeys: |- + -----BEGIN PUBLIC KEY----- + ... + -----END PUBLIC KEY-----
Container Forensics
Ketika container terkompromi, forensik container berbeda dari tradisional karena sifat ephemeral container. Evidence collection harus dilakukan sebelum container dihapus.
Bash — Container Forensics
# ============================================= +# Container Incident Response & Forensics +# ============================================= +# 1. Snapshot container filesystem (sebelum dihapus) +docker commit suspicious-container forensic-image:v1 +docker save forensic-image:v1 -o forensic-image.tar +# 2. Export container filesystem +docker export suspicious-container -o container-fs.tar +mkdir /forensics/container && tar xf container-fs.tar -C /forensics/container +# 3. Capture container memory +docker exec suspicious-container sh -c 'cat /proc/*/maps' > mem-maps.txt +# Or use AVML for memory capture +docker cp suspicious-container:/proc /forensics/proc +# 4. Collect container logs +docker logs suspicious-container > container-logs.txt 2>&1 +# 5. Network forensics +docker exec suspicious-container ss -tulnp > network-connections.txt +docker exec suspicious-container cat /etc/resolv.conf > dns-config.txt +# 6. Process forensics +docker top suspicious-container > process-list.txt +docker exec suspicious-container ps auxf > process-tree.txt +# 7. Analyze image layers +dive forensic-image:v1 +# Check each layer for suspicious additions +# 8. Timeline reconstruction +# Correlate timestamps from: +# - Container logs +# - Host audit logs (auditd) +# - Network flow logs +# - SIEM alerts
Container Monitoring with Prometheus
Container monitoring mendeteksi anomali runtime seperti resource abuse, suspicious process, dan network activity yang tidak biasa.
YAML — Container Monitoring
+# Prometheus alerts for container security
+groups:
+ - name: container-security
+ rules:
+ - alert: ContainerHighCPU
+ expr: container_cpu_usage_seconds_total > 0.9
+ for: 5m
+ labels:
+ severity: warning
+ annotations:
+ summary: "Container {{ $labels.name }} high CPU"
+ - alert: ContainerPrivilegeEscalation
+ expr: container_security_privileged == 1
+ labels:
+ severity: critical
+ annotations:
+ summary: "Privileged container detected"
+ 9. Quiz Pemahaman
1. Mengapa container harus non-root?
2. Fungsi image scanning?
3. Apa yang dilakukan '--cap-drop ALL'?
4. Mengapa 'latest' tag tidak untuk production?
5. Tool CIS benchmark audit untuk Docker?
Rangkuman
📝 Poin Penting
- Dockerfile — Fondasi keamanan — multi-stage, non-root, pin versions
- Image Scanning — Scan CVE di setiap stage: build, CI, registry, runtime
- Runtime — Capabilities, seccomp, read-only fs, resource limits
- K8s Security — Pod Security Standards, NetworkPolicy, RBAC
- Secrets — Gunakan External Secrets Operator, bukan env vars