xwtro0tk1t-cloud/harness/security-review-skill-for-docker

git diff --name-only <base>...<target>

git log --since="7 days ago" --name-only --pretty=format: | sort -u

# 发现 Dockerfile
Glob("**/Dockerfile*")
 
# 发现 docker-compose
Glob("**/docker-compose*.yml")
Glob("**/docker-compose*.yaml")
 
# 发现 K8s manifests
Glob("**/k8s/**/*.yml")
Glob("**/k8s/**/*.yaml")
Glob("**/deploy/**/*.yml")
Glob("**/manifests/**/*.yml")
Glob("**/helm/**/*.yaml")
Glob("**/.k8s/**/*.yaml")
 
# 发现 .dockerignore
Glob("**/.dockerignore")
 
# CI/CD 中的容器步骤
Glob("**/.github/workflows/*.yml")
Glob("**/.gitlab-ci.yml")
Glob("**/Jenkinsfile*")

# D1: Base Image 合规
Grep("^FROM ", glob="*Dockerfile*")                    # 所有 FROM 指令
Grep("FROM.*:latest", glob="*Dockerfile*")              # 禁止 :latest
Grep("FROM.*docker\\.io|FROM.*dockerhub", glob="*Dockerfile*")  # 禁止 Docker Hub 直拉
Grep("^FROM (?!jfrog\\.cmex\\.corp)", glob="*Dockerfile*")      # 必须用内部 registry
 
# D2: 权限控制
Grep("USER root", glob="*Dockerfile*")                  # 禁止 root 用户
Grep("--privileged", glob="*Dockerfile*")               # 禁止特权模式
Grep("chmod 777|chmod -R 777", glob="*Dockerfile*")     # 过宽文件权限
Grep("sudo ", glob="*Dockerfile*")                      # 容器内不应有 sudo
 
# D3: 密钥泄露
Grep("COPY.*\\.env|ADD.*\\.env", glob="*Dockerfile*")   # 禁止复制 .env
Grep("ARG.*PASSWORD|ARG.*SECRET|ARG.*TOKEN|ARG.*KEY", glob="*Dockerfile*", -i=true)  # ARG 传密钥
Grep("ENV.*PASSWORD|ENV.*SECRET|ENV.*TOKEN|ENV.*API_KEY", glob="*Dockerfile*", -i=true)  # ENV 硬编码
Grep("COPY.*\\.pem|COPY.*\\.key|COPY.*id_rsa", glob="*Dockerfile*")  # 复制私钥
 
# D4: 网络/SSH
Grep("EXPOSE 22|sshd|openssh", glob="*Dockerfile*")     # 禁止 SSH
Grep("EXPOSE.*0\\.0\\.0\\.0", glob="*Dockerfile*")      # 不安全绑定
 
# D5: 最佳实践
Grep("^ADD ", glob="*Dockerfile*")                       # ADD 改用 COPY
Grep("apt-get install(?!.*--no-install-recommends)", glob="*Dockerfile*")  # 缺少 --no-install-recommends
Grep("apk add(?!.*--no-cache)", glob="*Dockerfile*")     # 缺少 --no-cache
Grep("curl.*\\| ?bash|curl.*\\| ?sh|wget.*\\| ?sh", glob="*Dockerfile*")  # pipe to shell

# D6: 特权和安全
Grep("privileged: true", glob="*docker-compose*")        # 特权容器
Grep("network_mode: host", glob="*docker-compose*")      # 主机网络
Grep("pid: host", glob="*docker-compose*")               # 主机 PID
Grep("ipc: host", glob="*docker-compose*")               # 主机 IPC
Grep("cap_add:", glob="*docker-compose*")                 # 能力添加（需逐一审查）
 
# D7: 资源限制
Grep("deploy:", glob="*docker-compose*")                  # 检查是否设了 resources.limits
Grep("mem_limit|memory:", glob="*docker-compose*")        # 内存限制
 
# D8: 敏感挂载
Grep("docker\\.sock", glob="*docker-compose*")            # Docker socket 挂载
Grep("/etc:/|/var:/|/root:/|/home:/", glob="*docker-compose*")  # 宿主机敏感路径
Grep("volumes:.*:rw", glob="*docker-compose*")            # 可写挂载（检查必要性）
 
# D9: 密钥
Grep("PASSWORD|SECRET|TOKEN|API_KEY", glob="*docker-compose*", -i=true)  # 明文密钥

# D10: Pod 安全
Grep("privileged: true", glob="**/*.{yml,yaml}")         # 特权容器
Grep("allowPrivilegeEscalation: true", glob="**/*.{yml,yaml}")
Grep("runAsUser: 0|runAsNonRoot: false", glob="**/*.{yml,yaml}")  # root 运行
Grep("hostNetwork: true|hostPID: true|hostIPC: true", glob="**/*.{yml,yaml}")
Grep("hostPath:", glob="**/*.{yml,yaml}")                 # 宿主机路径挂载
 
# D11: RBAC
Grep("cluster-admin|system:masters", glob="**/*.{yml,yaml}")  # 过宽权限
Grep("resources:.*\\*|verbs:.*\\*", glob="**/*.{yml,yaml}")   # 通配符权限
 
# D12: 资源限制
Grep("resources:", glob="**/*.{yml,yaml}")                # 检查 limits 存在
Grep("limits:", glob="**/*.{yml,yaml}")                   # CPU/memory limits
 
# D13: Secrets
Grep("kind: Secret", glob="**/*.{yml,yaml}")              # 明文 Secret（应用 sealed-secrets/external-secrets）
Grep("stringData:", glob="**/*.{yml,yaml}")               # 明文数据

[
  {
    "title": "容器以 root 用户运行",
    "severity": "HIGH",
    "file": "Dockerfile",
    "line": 1,
    "description": "Dockerfile 缺少 USER 指令，容器默认以 root 运行。攻击者突破应用后直接获得 root 权限，可逃逸到宿主机。",
    "recommendation": "在最终 stage 添加非 root 用户：\nRUN addgroup -S app && adduser -S app -G app\nUSER app",
    "cwe_id": "CWE-250"
  }
]