April 2025
Intermediate to advanced
200 pages
5h 57m
Portuguese (Portugal, Brazil)
Content preview from Segurança de contentores
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
Apêndice. Lista de controlo de segurança
Este apêndice cobre alguns itens importantes que deves pelo menos pensar quando considerares a melhor forma de proteger as tuas implementações de contentores. No teu ambiente, pode não fazer sentido aplicar todos os itens, mas se pensares neles, terás um bom começo. Sem dúvida, esta lista não é absolutamente completa!
-
Estás a executar todos os contentores como um utilizador não-root? Consulte "Os contêineres são executados como Root por padrão".
-
Estás a executar algum contentor com a bandeira
--privileged? Estás a eliminar capacidades que não são necessárias para cada imagem? Vê "A flag --privileged e as capacidades". -
Estás a executar contentores como apenas de leitura sempre que possível? Vê "Contentores imutáveis".
-
Estás a verificar se existem diretórios sensíveis montados a partir do anfitrião? E quanto ao socket do Docker? Vê "Montando diretórios sensíveis" e "Montando o soquete Docker".
-
Estás a executar o teu pipeline CI/CD no teu cluster de produção? Tem acesso privilegiado ou usa o socket do Docker? Vê "Os perigos da construção do Docker".
-
Estás a analisar as tuas imagens de contentores em busca de vulnerabilidades? Tens um processo ou ferramentas implementadas para reconstruir e reimplementar contentores onde a imagem inclui vulnerabilidades? Consulte o Capítulo 7.
-
Estás a utilizar um perfil seccomp ou AppArmor? Os perfis predefinidos do Docker são um bom ponto de partida; melhor ainda seria encolher um perfil para ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.