📋 Daftar Isi
1. Pengenalan Container Security
Container Security mencakup praktik, tools, dan kebijakan untuk melindungi containerized applications sepanjang lifecycle — dari build, deploy, hingga runtime. Container membawa tantangan keamanan unik karena sharing kernel, ephemeral nature, dan jumlah yang sangat banyak.
📋 Container Security Lifecycle
- Build — Secure Dockerfile, base image, dependency scanning
- Ship — Image signing, registry security, vulnerability scanning
- Run — Runtime policies, network segmentation, resource limits
- Monitor — Audit logging, anomaly detection, compliance
Container Attack Vectors
Diagram: Container Attack Surface
Container Attack Surface
2. Dockerfile Security
Dockerfile adalah fondasi keamanan container. Kesalahan pada Dockerfile dapat menghasilkan image yang rentan.
Diagram
Image Signing with Cosign
Bash — Container Image Signing
# =============================================
+# Container Image Signing & Verification
+# =============================================
+# 1. Install cosign (Sigstore)
+go install github.com/sigstore/cosign/v2/cmd/cosign@latest
+# 2. Generate keypair
+cosign generate-key-pair
+# 3. Sign image
+cosign sign --key cosign.key registry.example.com/myapp:v1.0
+# 4. Verify signature
+cosign verify --key cosign.pub registry.example.com/myapp:v1.0
+# 5. Sign with keyless (OIDC identity)
+cosign sign registry.example.com/myapp:v1.0
+# Uses Fulcio for short-lived certificates
+# Uses Rekor for transparency log
+# 6. Enforce signature verification in K8s
+# Kyverno policy:
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+ name: verify-image-signatures
+spec:
+ validationFailureAction: enforce
+ rules:
+ - name: verify-cosign-signature
+ match:
+ resources:
+ kinds: ["Pod"]
+ verifyImages:
+ - imageReferences: ["registry.example.com/*"]
+ attestors:
+ - entries:
+ - keys:
+ publicKeys: |-
+ -----BEGIN PUBLIC KEY-----
+ ...
+ -----END PUBLIC KEY-----Container Forensics
Ketika container terkompromi, forensik container berbeda dari tradisional karena sifat ephemeral container. Evidence collection harus dilakukan sebelum container dihapus.
Bash — Container Forensics
# =============================================
+# Container Incident Response & Forensics
+# =============================================
+# 1. Snapshot container filesystem (sebelum dihapus)
+docker commit suspicious-container forensic-image:v1
+docker save forensic-image:v1 -o forensic-image.tar
+# 2. Export container filesystem
+docker export suspicious-container -o container-fs.tar
+mkdir /forensics/container && tar xf container-fs.tar -C /forensics/container
+# 3. Capture container memory
+docker exec suspicious-container sh -c 'cat /proc/*/maps' > mem-maps.txt
+# Or use AVML for memory capture
+docker cp suspicious-container:/proc /forensics/proc
+# 4. Collect container logs
+docker logs suspicious-container > container-logs.txt 2>&1
+# 5. Network forensics
+docker exec suspicious-container ss -tulnp > network-connections.txt
+docker exec suspicious-container cat /etc/resolv.conf > dns-config.txt
+# 6. Process forensics
+docker top suspicious-container > process-list.txt
+docker exec suspicious-container ps auxf > process-tree.txt
+# 7. Analyze image layers
+dive forensic-image:v1
+# Check each layer for suspicious additions
+# 8. Timeline reconstruction
+# Correlate timestamps from:
+# - Container logs
+# - Host audit logs (auditd)
+# - Network flow logs
+# - SIEM alertsContainer Monitoring with Prometheus
Container monitoring mendeteksi anomali runtime seperti resource abuse, suspicious process, dan network activity yang tidak biasa.
YAML — Container Monitoring
+# Prometheus alerts for container security
+groups:
+ - name: container-security
+ rules:
+ - alert: ContainerHighCPU
+ expr: container_cpu_usage_seconds_total > 0.9
+ for: 5m
+ labels:
+ severity: warning
+ annotations:
+ summary: "Container {{ $labels.name }} high CPU"
+ - alert: ContainerPrivilegeEscalation
+ expr: container_security_privileged == 1
+ labels:
+ severity: critical
+ annotations:
+ summary: "Privileged container detected"9. Quiz Pemahaman
1. Mengapa container harus non-root?
2. Fungsi image scanning?
3. Apa yang dilakukan '--cap-drop ALL'?
4. Mengapa 'latest' tag tidak untuk production?
5. Tool CIS benchmark audit untuk Docker?
Rangkuman
📝 Poin Penting
- Dockerfile — Fondasi keamanan — multi-stage, non-root, pin versions
- Image Scanning — Scan CVE di setiap stage: build, CI, registry, runtime
- Runtime — Capabilities, seccomp, read-only fs, resource limits
- K8s Security — Pod Security Standards, NetworkPolicy, RBAC
- Secrets — Gunakan External Secrets Operator, bukan env vars