Container & Cloud Security

# Dockerfile, Security-hardened Python application (multi-stage build)

# ── Stage 1: Build ────────────────────────────────────────────
FROM python:3.12-slim AS builder

WORKDIR /build

# Install dependencies in build stage
COPY requirements.txt .
RUN pip install --no-cache-dir --prefix=/install -r requirements.txt

# ── Stage 2: Runtime (minimal attack surface) ─────────────────
FROM python:3.12-slim AS runtime

# Create non-root user
RUN groupadd --gid 1001 appgroup && \
    useradd --uid 1001 --gid 1001 --no-create-home appuser

WORKDIR /app

# Copy only installed packages from build stage
COPY --from=builder /install /usr/local
COPY --chown=appuser:appgroup src/ ./src/

# Run as non-root
USER appuser

# Health check
HEALTHCHECK --interval=30s --timeout=3s CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"

EXPOSE 8000
CMD ["python", "-m", "uvicorn", "src.main:app", "--host", "0.0.0.0", "--port", "8000"]

# ── docker run security flags ──────────────────────────────────
# docker run \
#   --read-only \                  # Read-only root filesystem
#   --cap-drop ALL \               # Drop all Linux capabilities
#   --cap-add NET_BIND_SERVICE \   # Add back only what's needed (port < 1024)
#   --security-opt no-new-privileges \   # Prevent privilege escalation
#   --memory="256m" \              # Memory limit
#   --cpus="0.5" \                 # CPU limit
#   --tmpfs /tmp:rw,noexec \      # Writable temp directory
#   my-app:latest

# trivy, Container image vulnerability scanner

# Install (Linux)
# curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh

# Scan a local image
trivy image python:3.12-slim

# Scan with severity filter (only CRITICAL and HIGH)
trivy image --severity CRITICAL,HIGH python:3.12-slim

# Scan and output JSON for CI/CD processing
trivy image --format json --output results.json python:3.12-slim

# Fail CI/CD if any CRITICAL CVEs found
trivy image --exit-code 1 --severity CRITICAL python:3.12-slim

# ── Python: Parse trivy results ───────────────────────────────
import json

def parse_trivy_report(report_file: str) -> dict:
    """Parse trivy JSON output and summarize vulnerabilities."""
    with open(report_file) as f:
        report = json.load(f)

    summary = {"CRITICAL": 0, "HIGH": 0, "MEDIUM": 0, "LOW": 0}
    critical_cves = []

    for result in report.get("Results", []):
        for vuln in result.get("Vulnerabilities", []):
            severity = vuln.get("Severity", "UNKNOWN")
            if severity in summary:
                summary[severity] += 1
            if severity == "CRITICAL":
                critical_cves.append({
                    "id": vuln["VulnerabilityID"],
                    "package": vuln["PkgName"],
                    "fixed_in": vuln.get("FixedVersion", "No fix available"),
                })

    return {"summary": summary, "critical_cves": critical_cves}

# Example output structure
example = {"summary": {"CRITICAL": 2, "HIGH": 8, "MEDIUM": 15, "LOW": 31}, "critical_cves": [
    {"id": "CVE-2024-1234", "package": "libssl1.1", "fixed_in": "1.1.1w-0+deb11u1"},
    {"id": "CVE-2024-5678", "package": "libc6", "fixed_in": "2.31-13+deb11u9"},
]}
for sev, count in example["summary"].items():
    print(f"  {sev}: {count}")
print("Critical CVEs:")
for cve in example["critical_cves"]:
    print(f"  {cve['id']} in {cve['package']} → fix: {cve['fixed_in']}")

# kubernetes_security.yaml, Security-hardened Pod spec

apiVersion: v1
kind: Pod
metadata:
  name: secure-app
spec:
  # ── Pod-level security context ────────────────────────────
  securityContext:
    runAsNonRoot: true           # Refuse to run as root
    runAsUser: 1001              # Specific non-root UID
    runAsGroup: 1001
    fsGroup: 1001                # File system group
    seccompProfile:
      type: RuntimeDefault       # Restrict syscalls to common set

  containers:
  - name: app
    image: my-app:1.2.3         # Pin specific version, not 'latest'

    # ── Container-level security context ──────────────────
    securityContext:
      allowPrivilegeEscalation: false  # Prevent sudo/setuid
      readOnlyRootFilesystem: true     # Read-only filesystem
      capabilities:
        drop: ["ALL"]           # Drop all Linux capabilities
        add: []                 # Add back nothing

    # ── Resource limits ───────────────────────────────────
    resources:
      requests:
        memory: "64Mi"
        cpu: "100m"
      limits:
        memory: "128Mi"
        cpu: "250m"

    # ── Writable volume for temp files ────────────────────
    volumeMounts:
    - name: tmp
      mountPath: /tmp

  volumes:
  - name: tmp
    emptyDir: {}   # tmpfs, destroyed when pod exits

---
# NetworkPolicy, restrict pod-to-pod communication
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-only-frontend
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes: [Ingress]
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8080
  # Default deny: backend only accepts traffic from frontend pods