أمن الحاويات (Container Security)

# ❌ سيئ: المستخدم الجذر افتراضياً
FROM node:18
WORKDIR /app
COPY . .
RUN npm install
CMD ["node", "server.js"]

# ✅ جيد: إنشاء مستخدم غير جذر
FROM node:18-alpine
WORKDIR /app
COPY . .
RUN npm install && \
    addgroup -S appgroup && \
    adduser -S appuser -G appgroup
USER appuser
CMD ["node", "server.js"]

# استخدام الصور الرسمية والمصغرة
FROM node:18-alpine AS build
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production

FROM gcr.io/distroless/nodejs18:latest
WORKDIR /app
COPY --from=build /app/node_modules ./node_modules
COPY . .
USER nonroot
CMD ["server.js"]

# فحص الصورة باستخدام Docker Scout
docker scout quickread myapp:latest

# فحص مفصل مع توصيات
docker scout recommendations myapp:latest

# تثبيت Trivy
brew install trivy

# فحص الصورة
trivy image --severity HIGH,CRITICAL myapp:latest

# فحص ملفات المشروع
trivy filesystem --severity HIGH,CRITICAL .

# دمج مع CI/CD
trivy image --exit-code 1 --severity CRITICAL myapp:latest

# ❌ سيئ: كتابة secret في layer
FROM node:18-alpine
WORKDIR /app
COPY . .
ENV DB_PASSWORD=supersecret  # مكشوف!
RUN echo "$DB_PASSWORD" > config.txt  # مكشوف!
CMD ["node", "server.js"]

# ✅ جيد: استخدام BuildKit secrets
# docker build --secret id=db_password,env=DB_PASSWORD .
FROM node:18-alpine
WORKDIR /app
COPY . .
RUN --mount=type=secret,id=db_password \
    export DB_PASSWORD=$(cat /run/secrets/db_password) && \
    node setup.js
CMD ["node", "server.js"]

# تشغيل الحاوية بنظام ملفات read-only
FROM node:18-alpine
WORKDIR /app
COPY --chown=appuser:appgroup . .
USER appuser
CMD ["node", "server.js"]

# docker run مع read-only
docker run --read-only --tmpfs /tmp --tmpfs /var/run myapp:latest

# تحديد الموارد في Docker Compose
docker run \
  --memory="512m" \
  --cpus="0.5" \
  --memory-reservation="256m" \
  --kernel-memory="128m" \
  --pids-limit=100 \
  myapp:latest

# docker-compose.yml
services:
  app:
    image: myapp:latest
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE

# توقيع الصورة باستخدام Docker Content Trust
export DOCKER_CONTENT_TRUST=1
docker push myrepo/myapp:latest

# التحقق عند السحب
docker pull myrepo/myapp:latest

services:
  app:
    image: myapp:latest
    secrets:
      - db_password
      - api_key

secrets:
  db_password:
    file: ./secrets/db_password.txt
  api_key:
    external: true