August 2016
Intermediate to advanced
384 pages
9h 20m
Japanese
Content preview from Docker
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
307
13.4 ホストによるコンテナの分離
•
プロセス数に
ulimit
を適用します。この制限は、コンテナのユーザーに対してかけられ
るものなので、一見するよりも難しいことです。こうすることで、フォーク爆弾を
DoS
攻撃に使われる危険をなくすことができます（「
13.7.9
リソース制限の適用（
ulimit
）」 を
参照）。
•
攻撃者がデータを改変しにくいよう、内部的な通信を暗号化します。
加えて、システムの定期的な監査を行い、すべてが最新の状態であり、リソースを消費しすぎて
いるコンテナがないことを確認できるようにします。
identidock
のようなおもちゃのアプリケー
ションであっても、適用すべきセキュリティ対策は数多く存在し、考慮すべきことはそれ以上にた
くさんあります。
本章ではこの後、こういった防御などの実装の詳細を見ていきます。覚えておかなければならな
いのは、チェック項目や境界を増やせば増やすほど、本当に被害を受ける前に攻撃を止められる可
能性が高まるということです。
Docker
を不適切に使えば、新しい感染媒体ができてしまい、シス
テムのセキュリティを低くしてしまうことになります。しかし適切に使えば、隔離のレベルを追加
し、アプリケーションがシステムにダメージを与えうる範囲を制限することによって、
Docker
は
セキュリティを改善できるのです。
13.4
ホストによるコンテナの分離
複数のユーザー用にコンテナを動作させるマルチテナントの構成を採っている場合（組織内の
ユーザーなのか、外部の顧客なのかに関わらず） ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.