Ngiyaqiniseka ukuthi lokhu kuye kwenzeka kuwe: uzama ukuhlanganisa isitsha ukuze usisebenzisele wena, ufuna ukusenza siphephe kakhulu usebenzisa izitsha ezingenamalungelo Futhi ngokuzumayo, uzithola ubhajwe enkingeni yamaphutha emvume. Kuyacasula ukuchitha amahora uhlela amafolda kufolda yasekhaya yomsebenzisi bese uthola ukuthi isitsha asikwazi ukuwabhalela, noma ukuthi uma sikwenza, amafayela avelayo ku-host onakele. akunakwenzeka ukuphatha ngoba zingezomsebenzisi we-phantom.
Iqiniso liwukuthi, nakuba ukufakwa kwama-container kusheshise ukulethwa kwesofthiwe, kuvulele ithuba lezingozi ezinkulu. Ngokusho kwedatha yakamuva, iningi lezithombe zokukhiqiza liphethe [okungacacile - mhlawumbe "okungacacile" noma "okungacacile"] ubuthakathaka obubucayiLokhu kwenza ukuphepha kube yinsika engaxoxiswana ngayo. Akukhona nje ukuvimbela abaduni ukuthi basihlasele, kodwa nokuqonda ukuthi uhlelo lusebenza kanjani. inqubo yokuhlukanisa ukuze ingqalasizinda yethu ingabi yisisefo.
Ukuqonda uhlelo lokuphepha kwezitsha
Ukuze siyeke ukuqagela ngezimvume, sidinga kuqala ukwazi ukuthi sivikelani. Ukwakheka kwesitsha kuhlukaniswe ngezingqimba eziningana ezibalulekile. Okokuqala, sinayo isithombe sesitshaokuyipulani yokuqala; uma lokhu kusengozini, zonke izimo ozisebenzisayo ngeke zivikeleke. Yingakho kubalulekile ukuzisebenzisa izithombe eziyisisekelo ezithembekile futhi ubagcine benolwazi lwakamuva.
Bese kuba isikhathi sokusebenzaosebenza njengomlamuleli phakathi kwesistimu yokusebenza ye-host kanye nohlelo lokusebenza. Uma isikhathi sokusebenza sesiphelelwe yisikhathi, ingozi yokuthi ukuphunyuka kwesitsha Kulokhu kumele sengeze ukuhlelwa kabusha, njengoKubernetes, lapho Ukulawulwa kokufinyelela okusekelwe kundima (RBAC) Yiyona kuphela isithiyo sangempela esivimbela ukufinyelela okungagunyaziwe ku-API yokuphatha.
Asikwazi ukukhohlwa isistimu yokusebenza yomsingathiUma umhlaseli ekwazi ukulimaza i-kernel yomsingathi, ubamba okhiye besizinda sonke. Isincomo lapha sicacile: sebenzisa isistimu yokusebenza encane ukunciphisa indawo yokuhlasela. Okokugcina, inethiwekhi iyindawo yokungena evame kakhulu; cishe ama-30% okuphulwa kwemisebenzi kwenzeka ngenxa yokwehluleka kokuxhumana, ngakho-ke ukuhlukaniswa kwenethiwekhi kanye nokubethela kwe-TLS/SSL Ziyadingeka.
Inkinga yezimvume kanye nomsebenzisi oyinhloko
Inkinga evamile yabathandi bokuzilibazisa umsebenzi wokusebenza ngamavolumu. Udala ifolda, uyifake, bese kuthi, i-boom!, kube iphutha. imvume inqatshelweLokhu kwenzeka ngoba, ngokuzenzakalelayo, izitsha eziningi ziqala njengempande. Uma uzama ukuphoqa I-UID ne-GID ku-0 Ukuze uzenze zifane nomsebenzisi wakho ophethe, udala ibhuloho eliyingozi. Uma isitsha singakuvumeli ukuthi ulungiselele la ma-ID, uzogcina uchithe intambama uzama ukuthola ukuthi uhlelo lokusebenza lusebenzisa muphi umsebenzisi wangaphakathi ukwenza i- chown ibhukwana.
Isixazululo esisebenzayo ukusebenzisa umgomo welungelo elincaneAkufanele usebenzise noma yini njengempande ngaphandle uma kudingeka ngempela. Ukuze uxazulule inkinga yamafayela adalwe ngesitsha ongeke ukwazi ukuwasusa ku-host, kubalulekile ukumisa i-Dockerfile ngale miyalelo elandelayo: USER, ichaza umsebenzisi ongenamalungelo ngaphambi kokuba uhlelo lokusebenza luqale.
Uma usebenzisa i-Podman, umqondo wokuthi izitsha ezingenazimpande Kungokwemvelo futhi kuyasiza kakhulu, kodwa kudinga ukuthi uqonde ukuthi abasebenzisi be-host bahlelwe kanjani kubasebenzisi be-container. Ukuze kuvinjelwe izimvume ukuthi zingalawuleki, kungcono ukuthi uhlelo lokusebenza luklanywe ukuze lubhalele imizila ethile nokuthi imephu yevolumu Kwenziwa ngokucabangela i-UID yangempela yomsebenzisi oqala inqubo.
Amasu okwakha izithombe ezihlomile
Uma ufuna ukuyeka ukuhlupheka, kufanele ushintshe indlela owakha ngayo izithombe zakho. Enye indlela ephumelela kakhulu... ukwakhiwa kwezigaba eziningiNgokuyisisekelo, usebenzisa isithombe esinzima esinawo wonke amathuluzi okwakha ukukhiqiza i-binary, bese ukopisha lelo fayela kuphela esithombeni sokugcina. ukukhanya ngokweqile.
Ungaqhubeka nokusebenzisa isithombe qalaLokhu kudala isitsha esingenalutho nhlobo: akukho gobolondo, akukho mphathi wephakheji, uhlelo lwakho lokusebenza kuphela. Lokhu kwenza kube nzima kakhulu ngomhlaseli ukwenza imiyalo enonya uma ekwazi ukungena, njengoba Akukho mhumushi wemiyalo etholakalayo.
Esinye isinyathelo sokuphepha ukuhlanza isithombe sanoma iyiphi i-binary ngezimvume i-setuid noma i-setgidLezi zimvume zivumela ifayela ukuthi lisetshenziswe ngamalungelo omnikazi wefayela hhayi umsebenzisi oliqalisayo, okuyindlela enkulu... ukukhuphuka kwelungeloUmyalo olula wokusesha nokususa lezi zingcezu ngesikhathi sokwakha isithombe ungakusindisa ezinkingeni eziningi.
Izingozi zemodi enelungelo kanye namakhono e-Linux
Ngezinye izikhathi, ngenxa yokuphelelwa yithemba ngokungakwazi ukuxazulula inkinga yezimvume, siwela esilingweni sokusebenzisa ifulegi –okunelungeloKhohlwa ngokwenza lokho. Imodi enelungelo iphula ukuhlukaniswa kwesitsha futhi ikunikeze ukufinyelela okugcwele kumadivayisi omgcini. Kufana nokunikeza umuntu ongamazi izihluthulelo zendlu yakho ngoba nje wayengazi ukuthi angalivula kanjani isango lengadi.
Kunalokho, kufanele udlale nge Amakhono e-LinuxI-Docker inika isethi yezimvume ezizenzakalelayo (njenge-CAP_CHOWN noma i-CAP_NET_RAW). Uma uhlelo lwakho lokusebenza lungadingi ukulawula inethiwekhi ezingeni eliphansi, indlela ehlakaniphile kakhulu yile susa amakhono angadingekile bese wengeza kuphela lezo ezidingwa ngokuqinile yi- --cap-add.
Kulabo abaphatha izindawo ezibucayi kakhulu, kukhona ama-plugin okugunyaza njenge-opa-docker-authz. Lokhu kuvumela ukuvimba izingcingo ku-API ye-daemon ye-Docker nokuvimba noma yimuphi umzamo wokuqalisa isitsha kwimodi enelungelo, okuqinisekisa ukuthi akekho, ngisho nangephutha, oshiya umnyango uvulekele i-host.
Ukulungiswa nokugcinwa kwemvelo
Ungalibali ngosayizi wesithombe ongu-5MB uma usebenzisa i-Alpine Linux uma ibangela izinkinga zokuhambisana namalabhulali. Ngezinye izikhathi isithombe se-Debian esikhulu kancane siyathandeka. kuzinzile futhi kwaziwa yithimba. Okubalulekile ukusebenzisa ukuskena ubungozi Ipayipi le-CI/CD elizenzakalelayo ukuthola ama-CVE ngaphambi kokuba isithombe sifinyelele ekukhiqizweni.
Ngokuphathelene nesitoreji, kuvimbela uhlelo lokusebenza ukuthi lubhalele ohlelweni lwefayela eliyimpande. Lungiselela i- uhlelo lwefayela lokufunda kuphela (rootfs) futhi ichaza amavolumu athile kuphela edatha edinga ukuqhubeka. Lokhu akugcini nje ngokuphepha kakhulu, kodwa futhi kuphoqa ukwakheka okuhlanzekile kanye okungenafaukwenza kube lula ukukala okuvundlile.
Ngezinqubo ezihleliwe, ungafaki umsebenzi we-cron ngaphakathi kwesitsha sewebhusayithi. Umthetho wegolide uthi inqubo eyodwa ngesitsha ngasinyeIndlela ehlanzekile kakhulu ukusebenzisa isithombe sohlelo lwakho lokusebenza ukuqalisa isitsha sesikhashana esenza umsebenzi bese sizibhubhisa, noma ukuphatha i-cron kusuka kumphathi ngokubiza injini yesitsha usebenzisa imiyalo.
Ukuphepha kwesitsha kuyinqubo eqhubekayo ehilela ukuqeda ukufinyelela kwezimpande, ukukhawulela amakhono e-kernel, kanye nokususa amathuluzi angadingekile ezithombeni zesitsha. Ngokuhlanganisa abasebenzisi abangenamalungelo nokuqina kwesikhathi sokusebenza kanye nokuqapha okuqhubekayo, indawo ifinyelelwa lapho ukusebenza kungaphazamisi ubuqotho besistimu yomsingathi.
Umbhali oshisekayo ngomhlaba wamabhayithi nobuchwepheshe ngokujwayelekile. Ngiyathanda ukwabelana ngolwazi lwami ngokubhala, futhi yilokho engizokwenza kule bhulogi, ngikubonise zonke izinto ezithakazelisayo kakhulu ngamagajethi, isofthiwe, ihadiwe, izitayela zobuchwepheshe, nokuningi. Inhloso yami ukukusiza ukuthi uzulazule emhlabeni wedijithali ngendlela elula nejabulisayo.