Container আর Kubernetes নিরাপত্তা — image, runtime আর policy

# syntax=docker/dockerfile:1
FROM registry.example.com/base/python:3.13@sha256:50d858e0985ecc7f60418aaf0cc5ab587f42c2570a884095a9e8ccacd0f6545c AS build
WORKDIR /src
COPY requirements.txt .
RUN --mount=type=secret,id=pkg_token \
    PIP_INDEX_URL="https://build:$(cat /run/secrets/pkg_token)@pkg.example.com/simple" \
    pip install --prefix=/install -r requirements.txt
COPY app/ app/

FROM registry.example.com/base/python-runtime:3.13@sha256:50d858e0985ecc7f60418aaf0cc5ab587f42c2570a884095a9e8ccacd0f6545c
COPY --from=build /install /usr/local
COPY --from=build /src/app /app
USER 10001
ENTRYPOINT ["python", "/app/main.py"]

// Toy Dockerfile linter: text rules only, nothing is built. Edit BAD and run again.
const BAD = `FROM python:latest
ENV API_KEY=example-token
RUN curl -s https://example.com/setup.sh | sh
ADD https://example.com/app.tar.gz /app/
COPY . /app
CMD ["python", "/app/main.py"]`;
const GOOD = `FROM python:3.13-slim@sha256:aaaa
COPY app/ /app/
USER 10001
CMD ["python", "/app/main.py"]`;

function lint(text) {
  const out = [], lines = text.split('\n').map(s => s.trim());
  lines.forEach((l, i) => {
    const add = (sev, msg) => out.push(`L${i + 1} ${sev} ${msg}`);
    const from = l.match(/^FROM\s+(\S+)/i);
    if (from && !from[1].includes('@sha256:')) add('MED ', 'base image not pinned by digest');
    if (from && /:latest$/.test(from[1])) add('MED ', 'latest tag can change silently');
    if (/^(ENV|ARG)\s+\S*(KEY|TOKEN|SECRET|PASSWORD)/i.test(l)) add('HIGH', 'secret-like value stays in image history');
    if (/^RUN.*\|\s*(ba)?sh\b/i.test(l)) add('HIGH', 'remote script piped to shell, unverified');
    if (/^ADD\s+https?:/i.test(l)) add('MED ', 'remote ADD has no checksum');
    if (/^COPY\s+\.\s/i.test(l)) add('LOW ', 'whole context copied, check .dockerignore');
  });
  const users = lines.filter(l => /^USER\s/i.test(l));
  const last = users.length ? users[users.length - 1].split(/\s+/)[1] : null;
  if (last === null) out.push('END HIGH no USER line, runs as root by default');
  else if (last === 'root' || last === '0') out.push('END HIGH final USER is root');
  return out;
}
for (const [name, text] of [['BAD', BAD], ['GOOD', GOOD]]) {
  const res = lint(text);
  console.log(`${name}: ${res.length} finding(s)`);
  res.forEach(r => console.log('  ' + r));
}

apiVersion: v1
kind: Pod
metadata:
  name: shop-api
  namespace: shop
  labels:
    app: api
spec:
  automountServiceAccountToken: false
  securityContext:
    runAsNonRoot: true
    runAsUser: 10001
    runAsGroup: 10001
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: api
      image: registry.example.com/shop/api@sha256:50d858e0985ecc7f60418aaf0cc5ab587f42c2570a884095a9e8ccacd0f6545c
      ports:
        - containerPort: 8080
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop: ["ALL"]
      resources:
        requests:
          cpu: "100m"
          memory: "128Mi"
        limits:
          memory: "256Mi"
      volumeMounts:
        - name: tmp
          mountPath: /tmp
  volumes:
    - name: tmp
      emptyDir:
        sizeLimit: 64Mi

// Toy RBAC review: which subject reaches what? In-memory roles, no cluster involved.
const ROLES = {
  'pod-viewer':   [{ res: ['pods'], verbs: ['get', 'list'] }],
  'ci-deployer':  [{ res: ['pods', 'deployments'], verbs: ['get', 'list', 'create'] }],
  'secret-read':  [{ res: ['secrets'], verbs: ['list'] }],
  'binder':       [{ res: ['clusterroles'], verbs: ['bind'] }],
  'legacy-admin': [{ res: ['*'], verbs: ['*'] }],
};
const BINDINGS = [ // ns '*' stands for a ClusterRoleBinding
  { who: 'sa:shop/report',  role: 'pod-viewer',   ns: 'shop' },
  { who: 'sa:ci/deployer',  role: 'ci-deployer',  ns: 'shop' },
  { who: 'sa:ops/old-cron', role: 'legacy-admin', ns: '*' },
  { who: 'user:dev-a',      role: 'secret-read',  ns: 'shop' },
  { who: 'user:dev-b',      role: 'binder',       ns: '*' },
];
const hit = (list, v) => list.includes('*') || list.includes(v);
const mine = who => BINDINGS.filter(b => b.who === who);
const reach = (who, verb, res) => mine(who)
  .filter(b => ROLES[b.role].some(r => hit(r.res, res) && hit(r.verbs, verb)))
  .map(b => b.ns);
for (const who of new Set(BINDINGS.map(b => b.who))) {
  const notes = [];
  const wild = mine(who).some(b => ROLES[b.role]
    .some(r => r.res.includes('*') || r.verbs.includes('*')));
  if (wild) notes.push('CRITICAL wildcard rule');
  const sec = reach(who, 'list', 'secrets');
  if (sec.length) notes.push(`HIGH list secrets in ns ${sec}`);
  const pods = reach(who, 'create', 'pods');
  if (pods.length) notes.push(`HIGH create pods in ns ${pods}, can mount its secrets`);
  const bind = reach(who, 'bind', 'clusterroles');
  if (bind.length) notes.push(`HIGH bind verb in ns ${bind}, escalation path`);
  console.log(`${who}: ${notes.length ? notes.length + ' finding(s)' : 'OK'}`);
  notes.forEach(n => console.log('  ' + n));
}

// Toy auditor: nine restricted-style checks on in-memory pod objects, not a full PSA.
const CHECKS = [
  ['privileged off',        (p, c) => !c.privileged],
  ['no host namespaces',    p => !p.hostNetwork && !p.hostPID && !p.hostIPC],
  ['no hostPath',           p => !(p.volumes || []).some(v => v.hostPath)],
  ['no priv escalation',    (p, c) => c.allowPrivilegeEscalation === false],
  ['runAsNonRoot true',     (p, c) => (c.runAsNonRoot ?? p.runAsNonRoot) === true],
  ['runAsUser not 0',       (p, c) => (c.runAsUser ?? p.runAsUser) !== 0],
  ['seccomp set',           (p, c) => ['RuntimeDefault', 'Localhost'].includes(c.seccomp ?? p.seccomp)],
  ['capabilities drop ALL', (p, c) => (c.drop || []).includes('ALL')],
  ['add only NET_BIND',     (p, c) => (c.add || []).every(x => x === 'NET_BIND_SERVICE')],
];
const PODS = {
  'report-worker': { runAsUser: 0, volumes: [{ hostPath: '/var/run/docker.sock' }],
    containers: [{ privileged: true }] },
  'plain-default': { containers: [{}] },
  'shop-api': { runAsNonRoot: true, runAsUser: 10001, seccomp: 'RuntimeDefault',
    containers: [{ allowPrivilegeEscalation: false, drop: ['ALL'] }] },
  'two-containers': { runAsNonRoot: true, seccomp: 'RuntimeDefault', containers: [
    { allowPrivilegeEscalation: false, drop: ['ALL'] },
    { allowPrivilegeEscalation: false, drop: ['ALL'], add: ['SYS_ADMIN'] }] },
};
for (const [name, pod] of Object.entries(PODS)) {
  const failed = CHECKS.filter(([, ok]) => !pod.containers.every(c => ok(pod, c)));
  const score = CHECKS.length - failed.length;
  console.log(`${name}: ${score}/${CHECKS.length} ${failed.length ? 'REJECT' : 'PASS'}`);
  failed.forEach(([label]) => console.log('  fail: ' + label));
}

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
  namespace: shop
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: web-to-api
  namespace: shop
spec:
  podSelector:
    matchLabels:
      app: api
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: web
      ports:
        - protocol: TCP
          port: 8080
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns
  namespace: shop
spec:
  podSelector: {}
  policyTypes:
    - Egress
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53

// Toy NetworkPolicy evaluator: no packets, only in-memory labels and rules.
const PODS = { web: { app: 'web' }, api: { app: 'api' }, db: { app: 'db' }, batch: { app: 'batch' } };
const POLICIES = [
  { name: 'default-deny', select: {}, types: ['ingress', 'egress'] },
  { name: 'web-out', select: { app: 'web' }, types: ['egress'],
    egress: [{ peer: { app: 'api' }, port: 8080 }] },
  { name: 'api-rules', select: { app: 'api' }, types: ['ingress', 'egress'],
    ingress: [{ peer: { app: 'web' }, port: 8080 }],
    egress: [{ peer: { app: 'db' }, port: 5432 }] },
  { name: 'db-in', select: { app: 'db' }, types: ['ingress'],
    ingress: [{ peer: { app: 'api' }, port: 5432 }] },
  { name: 'batch-out', select: { app: 'batch' }, types: ['egress'],
    egress: [{ peer: { app: 'db' }, port: 5432 }] },
];
const sel = (s, pod) => Object.entries(s).every(([k, v]) => PODS[pod][k] === v);
function side(pols, pod, dir, peer, port) {
  const mine = pols.filter(q => q.types.includes(dir) && sel(q.select, pod));
  if (mine.length === 0) return true;      // not isolated in this direction
  return mine.some(q => (q[dir] || []).some(r => sel(r.peer, peer) && r.port === port));
}
const FLOWS = [['web', 'api', 8080], ['api', 'db', 5432], ['web', 'db', 5432],
               ['batch', 'db', 5432], ['api', 'web', 8080]];
function show(title, pols) {
  console.log(title);
  for (const [src, dst, port] of FLOWS) {
    const out = side(pols, src, 'egress', dst, port);
    const inn = side(pols, dst, 'ingress', src, port);
    console.log(`  ${out && inn ? 'ALLOW' : 'DENY '} ${src} -> ${dst}:${port} egress=${out} ingress=${inn}`);
  }
}
show('no policy at all:', []);
show('default deny plus allow rules:', POLICIES);

- rule: Shell in shop container
  desc: A shell started inside a production pod
  condition: >
    spawned_process and container
    and proc.name in (sh, bash)
    and k8s.ns.name = "shop"
  output: >
    shell started (pod=%k8s.pod.name ns=%k8s.ns.name
    cmd=%proc.cmdline user=%user.name)
  priority: WARNING
  tags: [container, shell]