August 2016
Intermediate to advanced
384 pages
9h 20m
Japanese
Content preview from Docker
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
338
13 章 セキュリティとコンテナに対する制限
に寄せられたアドバイス（
https://serverfault.com/questions/218005/how-do-i-deal-with-a-
compromised-server
）を読んでみてください。
13.12
将来の機能
セキュリティに関する
Docker
の機能の中には、開発中のものもあります。こういった機能は
Docker
が優先しているので、本書が刊行される頃には、そういった機能が登場していることで
しょう。
seccomp
Linux
の
seccomp
（あるいは
secure comuting mode
）を使えば、プロセスが発行できるシ
ステムコールを制限できます。
seccomp
が特に使われているのはブラウザで、
Chrome
と
Firefox
の両方でプラグインをサンドボックス化するために使われています。
seccomp
を
Docker
と結合すれば、コンテナから呼べるシステムコールを特定のグループに限定できます。
提唱されている
Docker
と
seccomp
の結合では、デフォルトで
32bit
のシステムコール、古
いネットワーク、通常コンテナがアクセスする必要がないさまざまなシステムの機能の呼び出
しが拒否されることになるでしょう。加えて、他の呼び出しは実行時に明示的に拒否もしくは
許可できることになるでしょう。例えば以下のコードは、
Nettwork Time Protocol
デーモン
を使ってシステムの時刻を同期するのに必要な
clock_adjtime ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.