容器镜像构建：多阶段构建与安全扫描

# ============================================
# Stage 1: Build - 编译构建
# ============================================
FROM node:20-alpine AS builder
 
# 构建元数据
LABEL maintainer="platform-team@example.com"
LABEL build-type="multi-stage"
 
WORKDIR /app
 
# 优先复制依赖声明文件，利用层缓存
COPY package.json package-lock.json ./
 
# 安装依赖（包括 devDependencies）
RUN npm ci --ignore-scripts
 
# 复制源代码
COPY . .
 
# 执行构建
RUN npm run build
 
# ============================================
# Stage 2: Test - 运行测试
# ============================================
FROM builder AS tester
 
WORKDIR /app
 
# 运行单元测试和集成测试
RUN npm run test:ci
 
# 运行安全审计
RUN npm audit --audit-level=high --omit=dev || true
 
# ============================================
# Stage 3: Production Dependencies - 仅生产依赖
# ============================================
FROM node:20-alpine AS prod-deps
 
WORKDIR /app
 
COPY package.json package-lock.json ./
 
# 仅安装生产依赖
RUN npm ci --omit=dev --ignore-scripts && \
    npm cache clean --force
 
# ============================================
# Stage 4: Runtime - 生产运行时
# ============================================
FROM gcr.io/distroless/nodejs20-debian12 AS runtime
 
# 添加非 root 用户标签
LABEL org.opencontainers.image.authors="platform-team"
LABEL org.opencontainers.image.title="my-app"
LABEL org.opencontainers.image.description="Production Node.js application"
 
WORKDIR /app
 
# 从 prod-deps 阶段复制生产依赖
COPY --from=prod-deps /app/node_modules ./node_modules
 
# 从 builder 阶段复制构建产物
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/package.json ./
 
# 使用非 root 用户运行（distroless 已包含 nonroot 用户）
USER nonroot:nonroot
 
# 健康检查端口
EXPOSE 3000
 
# 启动命令
CMD ["dist/main.js"]

# ============================================
# Stage 1: Build
# ============================================
FROM golang:1.22-alpine AS builder
 
# 安装安全相关的编译标志
ENV CGO_ENABLED=0
ENV GOOS=linux
ENV GOARCH=amd64
 
WORKDIR /src
 
# 依赖缓存优化
COPY go.mod go.sum ./
RUN go mod download
 
# 复制源代码并构建
COPY . .
 
# 静态编译，启用安全编译选项
RUN go build \
    -ldflags="-w -s -extldflags '-static'" \
    -trimpath \
    -o /app/server ./cmd/server
 
# ============================================
# Stage 2: Runtime - 使用 scratch 镜像
# ============================================
FROM scratch AS runtime
 
# 从 builder 复制 CA 证书（HTTPS 请求必需）
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
 
# 从 builder 复制时区数据
COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo
 
# 从 builder 复制二进制文件
COPY --from=builder /app/server /server
 
# 从 builder 复制 passwd 文件（nonroot 用户）
COPY --from=builder /etc/passwd /etc/passwd
 
USER nonroot:nonroot
 
EXPOSE 8080
 
ENTRYPOINT ["/server"]

# .dockerignore - 排除无关文件，减小构建上下文
# 版本控制
.git
.gitignore
 
# 依赖目录（会在构建中重新安装）
node_modules
vendor
 
# 构建产物（会在构建中重新生成）
dist
build
.next
out
 
# 测试和文档
coverage
*.test.ts
*.spec.ts
docs
*.md
!README.md
 
# IDE 和编辑器
.vscode
.idea
*.swp
*.swo
 
# 环境文件（不应打包进镜像）
.env
.env.local
.env.*.local
 
# Docker 相关
Dockerfile
docker-compose*.yml
.dockerignore
 
# CI/CD
.github
.gitlab-ci.yml
Jenkinsfile

# Dockerfile - 参数化构建
ARG NODE_VERSION=20
ARG ALPINE_VERSION=3.19
ARG APP_PORT=3000
 
FROM node:${NODE_VERSION}-alpine${ALPINE_VERSION} AS builder
 
ARG BUILD_ENV=production
ARG COMMIT_SHA
ARG BUILD_DATE
 
# 将 ARG 传递到运行时环境变量
ENV NODE_ENV=${BUILD_ENV}
ENV COMMIT_SHA=${COMMIT_SHA}
ENV BUILD_DATE=${BUILD_DATE}
 
# 构建标签
LABEL org.opencontainers.image.revision=${COMMIT_SHA}
LABEL org.opencontainers.image.created=${BUILD_DATE}
 
WORKDIR /app
COPY package*.json ./
RUN npm ci --omit=dev
COPY . .
RUN npm run build
 
FROM gcr.io/distroless/nodejs${NODE_VERSION}-debian12
COPY --from=builder /app /app
USER nonroot:nonroot
EXPOSE ${APP_PORT}
CMD ["app/dist/main.js"]

# 构建时传入参数
docker build \
  --build-arg NODE_VERSION=20 \
  --build-arg COMMIT_SHA=$(git rev-parse HEAD) \
  --build-arg BUILD_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ") \
  -t my-app:latest .

# Dockerfile with BuildKit features
# syntax=docker/dockerfile:1
 
FROM node:20-alpine AS builder
 
WORKDIR /app
 
# 使用缓存挂载加速 npm install
COPY package.json package-lock.json ./
RUN --mount=type=cache,target=/root/.npm \
    npm ci
 
# 使用安全 secret 挂载（不写入镜像层）
RUN --mount=type=secret,id=npmrc,target=/root/.npmrc \
    npm ci --omit=dev
 
# 使用 SSH agent 转发（私有 Git 仓库）
RUN --mount=type=ssh \
    npm ci --omit=dev
 
COPY . .
RUN npm run build
 
# 多平台构建支持
FROM --platform=$BUILDPLATFORM node:20-alpine AS cross-builder
ARG TARGETPLATFORM
ARG BUILDPLATFORM
RUN echo "Building on $BUILDPLATFORM for $TARGETPLATFORM"

# .github/workflows/container-security.yml
name: Container Security Scan
 
on:
  push:
    branches: [main]
  pull_request:
    paths:
      - 'Dockerfile'
      - 'package.json'
      - 'package-lock.json'
 
jobs:
  build-and-scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
      packages: write
 
    steps:
      - name: Checkout
        uses: actions/checkout@v4
 
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
 
      - name: Build image
        uses: docker/build-push-action@v5
        with:
          context: .
          load: true
          tags: |
            my-app:${{ github.sha }}
            my-app:scan-target
          cache-from: type=gha
          cache-to: type=gha,mode=max
 
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'my-app:scan-target'
          format: 'table'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
 
      - name: Run Trivy SARIF report
        if: always()
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'my-app:scan-target'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH,MEDIUM'
 
      - name: Upload Trivy scan results to GitHub Security
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'
 
      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          image: 'my-app:scan-target'
          format: 'spdx-json'
          output-file: 'sbom.spdx.json'
 
      - name: Upload SBOM as artifact
        uses: actions/upload-artifact@v4
        with:
          name: sbom
          path: 'sbom.spdx.json'

#!/bin/bash
# trivy-scan.sh - 完整的镜像安全扫描脚本
 
IMAGE_NAME="my-app:latest"
 
echo "=== 1. 漏洞扫描 ==="
# 扫描高危和严重漏洞，发现则退出
trivy image \
  --severity CRITICAL,HIGH \
  --exit-code 1 \
  --ignore-unfixed \
  --format table \
  ${IMAGE_NAME}
 
echo "=== 2. 生成 SARIF 报告 ==="
# 生成 SARIF 格式报告（用于 GitHub Security 集成）
trivy image \
  --format sarif \
  --output trivy-results.sarif \
  ${IMAGE_NAME}
 
echo "=== 3. Secret 扫描 ==="
# 扫描镜像中可能泄露的密钥和凭证
trivy image \
  --scanners secret \
  --format table \
  ${IMAGE_NAME}
 
echo "=== 4. 配置扫描 ==="
# 扫描 Dockerfile 和 K8s 配置文件
trivy config \
  --severity CRITICAL,HIGH,MEDIUM \
  --format table \
  ./Dockerfile ./k8s/
 
echo "=== 5. 生成 SBOM ==="
# 生成软件物料清单
trivy image \
  --format spdx-json \
  --output sbom.spdx.json \
  ${IMAGE_NAME}
 
echo "=== 6. SBOM 扫描 ==="
# 基于 SBOM 进行离线漏洞扫描
trivy sbom \
  --severity CRITICAL,HIGH \
  --format table \
  sbom.spdx.json

# .github/workflows/image-signing.yml
name: Build, Scan, and Sign Container Image
 
on:
  push:
    branches: [main]
 
env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
 
jobs:
  build-scan-sign:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write  # Cosign keyless 签名需要
 
    steps:
      - name: Checkout
        uses: actions/checkout@v4
 
      - name: Install Cosign
        uses: sigstore/cosign-installer@v3
 
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
 
      - name: Login to Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
 
      - name: Build and push
        id: build
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max
 
      - name: Run Trivy scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}'
          format: 'table'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'
          ignore-unfixed: true
 
      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          image: '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}'
          format: 'spdx-json'
          output-file: 'sbom.spdx.json'
 
      - name: Sign image with Cosign (Keyless)
        run: |
          cosign sign --yes \
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}
 
      - name: Attach SBOM to image
        run: |
          cosign attach sbom --sbom sbom.spdx.json \
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}
 
      - name: Sign SBOM
        run: |
          cosign sign --yes \
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:sha256-$(echo ${{ steps.build.outputs.digest }} | cut -d':' -f2).sbom
 
      - name: Verify signature
        run: |
          cosign verify \
            --certificate-identity=https://github.com/${{ github.repository }}/.github/workflows/image-signing.yml@refs/heads/main \
            --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}

# k8s/policies/verify-image-signature.yml
# 使用 Kyverno 策略引擎强制验证镜像签名
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-image-signature
  annotations:
    policies.kyverno.io/title: Verify Image Signature
    policies.kyverno.io/description: >-
      Require all images deployed to the cluster to be signed
      with Cosign using Sigstore.
spec:
  validationFailureAction: Enforce
  background: false
  rules:
    - name: verify-cosign-signature
      match:
        any:
          - resources:
              kinds:
                - Pod
      verifyImages:
        - imageReferences:
            - "ghcr.io/my-org/*"
          attestors:
            - entries:
                - keyless:
                    subject: "https://github.com/my-org/my-app/.github/workflows/image-signing.yml"
                    issuer: "https://token.actions.githubusercontent.com"
          attestations:
            - type: https://spdx.dev/Document
              conditions:
                - all:
                    - key: "{{ data.payloadPredicate.sbomType }}"
                      operator: Equals
                      value: "spdx"

# k8s/ci/kaniko-build.yml
apiVersion: v1
kind: Pod
metadata:
  name: kaniko-build
  labels:
    app: kaniko
    purpose: image-build
spec:
  restartPolicy: Never
  containers:
    - name: kaniko
      image: gcr.io/kaniko-project/executor:latest
      args:
        - --dockerfile=Dockerfile
        - --context=git://github.com/my-org/my-app.git#refs/heads/main
        - --destination=ghcr.io/my-org/my-app:latest
        - --cache=true
        - --cache-repo=ghcr.io/my-org/my-app/cache
        - --cache-ttl=72h
        - --snapshot-mode=redo
        - --use-new-run=true
        - --build-arg=COMMIT_SHA=$(git rev-parse HEAD)
      env:
        - name: GIT_TOKEN
          valueFrom:
            secretKeyRef:
              name: git-credentials
              key: token
      volumeMounts:
        - name: docker-config
          mountPath: /kaniko/.docker
  volumes:
    - name: docker-config
      configMap:
        name: docker-config
---
# docker-config ConfigMap
apiVersion: v1
kind: ConfigMap
metadata:
  name: docker-config
data:
  config.json: |
    {
      "auths": {
        "ghcr.io": {
          "auth": "BASE64_ENCODED_CREDENTIALS"
        }
      }
    }

# 使用 pack CLI 构建
pack build my-app:latest \
  --builder paketobuildpacks/builder-jammy-full \
  --env NODE_ENV=production \
  --cache-image ghcr.io/my-org/my-app-cache:latest
 
# 使用 pack 构建并生成 SBOM
pack build my-app:latest \
  --builder paketobuildpacks/builder-jammy-full \
  --sbom-output-dir ./sbom-output

# project.toml - Buildpacks 项目配置
[project]
id = "my-app"
name = "My Application"
version = "1.0.0"
 
[[build.env]]
name = "NODE_ENV"
value = "production"
 
[[build.env]]
name = "NPM_CONFIG_PRODUCTION"
value = "true"
 
[build]
exclude = [
    "node_modules",
    ".git",
    "coverage",
    "docs"
]

# .github/workflows/optimized-container-build.yml
name: Optimized Container Build
 
on:
  push:
    branches: [main]
  pull_request:
 
env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
 
jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      digest: ${{ steps.build.outputs.digest }}
      changed: ${{ steps.check.outputs.changed }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 2
 
      # 检查是否需要重新构建镜像
      - name: Check if Dockerfile or dependencies changed
        id: check
        run: |
          if git diff --name-only HEAD^ HEAD | grep -qE '(Dockerfile|package.json|package-lock.json|src/)'; then
            echo "changed=true" >> $GITHUB_OUTPUT
          else
            echo "changed=false" >> $GITHUB_OUTPUT
          fi
 
      - name: Set up Docker Buildx
        if: steps.check.outputs.changed == 'true'
        uses: docker/setup-buildx-action@v3
 
      - name: Login to Registry
        if: steps.check.outputs.changed == 'true'
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
 
      - name: Build and push
        if: steps.check.outputs.changed == 'true'
        id: build
        uses: docker/build-push-action@v5
        with:
          context: .
          push: ${{ github.ref == 'refs/heads/main' }}
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
          cache-from: type=gha,scope=${{ github.ref_name }}
          cache-to: type=gha,mode=max,scope=${{ github.ref_name }}
          build-args: |
            COMMIT_SHA=${{ github.sha }}
            BUILD_DATE=${{ github.event.head_commit.timestamp }}
 
  scan:
    needs: build
    if: needs.build.outputs.changed == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Run Trivy scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}'
          format: 'table'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'
          ignore-unfixed: true

#!/bin/bash
# image-metrics.sh - 镜像构建效能度量
 
IMAGE="my-app:latest"
 
echo "=== Image Metrics Report ==="
echo "Image: ${IMAGE}"
echo "Date: $(date -u +"%Y-%m-%dT%H:%M:%SZ")"
echo ""
 
# 1. 镜像体积
SIZE=$(docker image inspect ${IMAGE} --format='{{.Size}}' 2>/dev/null)
SIZE_MB=$((SIZE / 1024 / 1024))
echo "Image Size: ${SIZE_MB} MB"
 
# 2. 层数
LAYERS=$(docker image inspect ${IMAGE} --format='{{len .RootFS.Layers}}' 2>/dev/null)
echo "Number of Layers: ${LAYERS}"
 
# 3. 安全漏洞统计
VULN_CRITICAL=$(trivy image --format json --severity CRITICAL ${IMAGE} 2>/dev/null | jq '.Results[].Vulnerabilities | length' 2>/dev/null | awk '{s+=$1} END {print s}')
VULN_HIGH=$(trivy image --format json --severity HIGH ${IMAGE} 2>/dev/null | jq '.Results[].Vulnerabilities | length' 2>/dev/null | awk '{s+=$1} END {print s}')
echo "Critical CVEs: ${VULN_CRITICAL:-0}"
echo "High CVEs: ${VULN_HIGH:-0}"
 
# 4. 签名验证
if cosign verify ${IMAGE} 2>/dev/null; then
  echo "Signature: VERIFIED"
else
  echo "Signature: NOT SIGNED"
fi
 
# 5. SBOM 可用性
if cosign download sbom ${IMAGE} 2>/dev/null | head -1 | grep -q spdx; then
  echo "SBOM: AVAILABLE"
else
  echo "SBOM: NOT ATTACHED"
fi
 
# 6. 运行用户
RUN_USER=$(docker image inspect ${IMAGE} --format='{{.Config.User}}' 2>/dev/null)
if [ -z "$RUN_USER" ] || [ "$RUN_USER" = "root" ] || [ "$RUN_USER" = "0" ]; then
  echo "Run User: WARNING - Running as root!"
else
  echo "Run User: ${RUN_USER} (OK)"
fi