Scenario Based Docker Security

你好！欢迎来到 Linux Academy 的基于场景的 Docker 安全课程。这是与保护容器相关的 4 门课程学习路径的第二门课程。此处提供的课程侧重于 Docker 的安全性方面，通过这些课程，您将学习如何在安全性上下文中执行各种配置并浏览不同的情况。有一个没有安全漏洞的正确配置，并让你的软件源（如容器镜像）尽可能安全是非常重要的。

在本课程的第一部分，我们将从如何正确​​安装和配置 Docker 的指南开始。我们将讨论资源限制，您将在其中了解 Linux cgroups 以及如何使用它们对系统的不同方面施加限制，以及了解如何监控资源和进程使用情况。之后，我们将转到 Seccomp – 安全计算模式并学习如何配置 seccomp 配置文件。Seccomp 是一种安全工具机制，Docker 可以使用它来实现额外的安全性。

保护软件源是极其重要的，这就是为什么我们将回顾创建存储库、创建映像、将其推送到存储库、拉取它、进行一些更改、将其推回等等的整个过程，同时牢记整个时间如何达到最佳安全性。这就是为什么我们会讨论诸如创建 SSL 证书之类的话题，以便我们和软件源之间的流量被加密。这将使用 Certbot 和 Let’s Encrypt 来实现。我们将讨论私有存储库和自定义图像的安全优势。您将学习如何从头开始创建自定义映像，特别是两个映像，其中一个是 Web 服务器映像，另一个是 MySql 数据库映像。之后，我们将仔细研究 Docker Bench。它是一种安全工具，也用于优化。

完成所有这些后，本课程的最后一部分将致力于部署和保护应用程序后端。这些视频可以看作是一种小型项目，可以回顾迄今为止所学的知识。我们将配置一个 Docker 容器来运行 Apache Web 服务器作为应用程序后端。我们将配置一个 Docker 容器，我们需要为其创建一个自定义映像来运行 Python 应用程序（更具体地说是 Flask 应用程序）。此应用程序将具有一个功能齐全的活动 API，它将实现与数据库的连接，我们还需要为其构建一个容器。因此，我们将有两个 Docker 容器相互通信。我们还将设置一个 Apache 网络服务器，作为通往外部世界的门户，可以这么说。它将用作反向代理，以允许来自外部世界的连接到达我们的容器。Certbot 将用于为我们的域创建 SSL 证书。

Video: .MP4, 1920×1080 30 fps | Audio: AAC, 44.1 kHz, 2ch | Duration: 9h 29m
Genre: eLearning | Language: English | Size: 1.95 GB

Hello! Welcome to Linux Academy’s Scenario Based Docker Security course. This is the second course of a 4 course learning path related to securing containers. The lessons that are presented here focus on the security aspect of Docker through which you will learn how to perform various configurations and navigate through different situations within the context of security. Having a proper configuration without security loopholes and having your software sources, such as container images, as secure as possible is very important.

In the first part of this course, we will begin with a guide on how to install and configure Docker properly. We will talk about resource restrictions where you will learn about Linux cgroups and how they can be used to pose limits on different aspects of your system, as well as learn how to monitor resource and process usage. After that, we will move on to Seccomp – Secure Computing Mode and learn how to configure seccomp profiles. Seccomp is a security tool mechanism that Docker can use to achieve additional security.

Securing software sources is extremely important, which is why we will go over the whole process of creating a repository, creating an image, pushing it to the repository, pulling it, doing some changes, pushing it back and so forth, while keeping in mind the whole time how to achieve optimal security. This is why we will talk about topics such as creating SSL certificates so that the traffic between us and the software source is encrypted. This will be achieved using Certbot and Let’s Encrypt. We will talk about the security advantages of private repositories and custom images. You will learn how to create custom images from scratch, specifically two images, where one will be a web server image and the other a MySql Database image. After that, we will take a closer look at Docker Bench. It is a security tool that is also used for optimization. When it runs, it performs a series of scans that give you suggestions on what should or shouldn’t be fixed.

When all of this is done, the last part of this course is dedicated to deploying and securing an applications backend. These videos can be viewed as a sort of mini project and review of what has been learned so far. We will be configuring a Docker container to run an Apache web server as an application back end. We will configure a Docker container for which we need to create a custom image to run a Python application (more specifically a Flask application). This application will have an active API that is fully functional and it will achieve a connection to a database for which we will also need to construct a container. So, we will have two Docker containers communicating between each other. We will also set up an Apache web server that will be a gateway to the outer world, so to say. It will be used as a reverse proxy to allow connections from the outer world to reach our containers. Certbot will be utilized for creating an SSL certificate for our domain.