コンテナセキュリティ：イメージスキャンからランタイム保護までの多層防御

# ビルドステージ
FROM node:18-alpine AS build
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
RUN npm run build

# 実行ステージ
FROM node:18-alpine
# 非root特権ユーザーを作成
RUN addgroup -g 1001 -S appgroup && \
    adduser -u 1001 -S appuser -G appgroup
# セキュリティ強化
RUN apk add --no-cache dumb-init
WORKDIR /app
# 必要なファイルのみコピー
COPY --from=build --chown=appuser:appgroup /app/dist /app/dist
COPY --from=build --chown=appuser:appgroup /app/node_modules /app/node_modules
COPY --from=build --chown=appuser:appgroup /app/package.json /app

# 非root特権ユーザーに切り替え
USER appuser
# dumb-initをentrypointとして使用
ENTRYPOINT ["dumb-init", "--"]
CMD ["node", "dist/index.js"]

name: Container Image Scan

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  scan:
    name: Scan Docker image
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Build image
        run: docker build -t myapp:${{ github.sha }} .

      - name: Trivy vulnerability scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: myapp:${{ github.sha }}
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'
          ignore-unfixed: true

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        if: always()
        with:
          sarif_file: 'trivy-results.sarif'
          
      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          image: myapp:${{ github.sha }}
          format: spdx-json
          output-file: ./sbom.json

      - name: Archive SBOM
        uses: actions/upload-artifact@v3
        with:
          name: sbom
          path: ./sbom.json

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-privileged-containers
spec:
  validationFailureAction: enforce
  rules:
  - name: privileged-containers
    match:
      resources:
        kinds:
        - Pod
    validate:
      message: "特権コンテナは許可されていません"
      pattern:
        spec:
          containers:
          - name: "*"
            securityContext:
              privileged: false

# Harbor V2.x プロジェクト自動スキャン設定
project:
  name: secured-apps
  metadata:
    auto_scan: "true"
    reuse_sys_cve_allowlist: "true"
    severity: "high"
  cve_allowlist:
    items:
    - cve_id: "CVE-2021-12345"
      description: "低リスクと評価された脆弱性"

apiVersion: v1
kind: Pod
metadata:
  name: secure-app
spec:
  securityContext:
    fsGroup: 2000
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 3000
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: app
    image: myapp:1.0.0
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop:
        - ALL
      runAsNonRoot: true
      runAsUser: 1000
      privileged: false

- rule: Terminal Shell in Container
  desc: >
    コンテナ内でのターミナルシェルの使用を検知します。
    コンテナは通常、アプリケーションのみを実行し、対話的シェルは使用しません。
  condition: >
    container.id != host and
    proc.name = bash and
    container
  output: >
    コンテナ内でシェルが実行されました (user=%user.name %container.info shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline)
  priority: WARNING
  tags: [container, shell, mitre_execution]

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-allow
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: api
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8080
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: database
    ports:
    - protocol: TCP
      port: 5432

apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
metadata:
  name: encryption-config
resources:
  - resources:
      - secrets
    providers:
      - aescbc:
          keys:
            - name: key1
              secret: <BASE64_ENCODED_KEY>
      - identity: {}

apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration
plugins:
- name: PodSecurity
  configuration:
    apiVersion: pod-security.admission.config.k8s.io/v1
    kind: PodSecurityConfiguration
    defaults:
      enforce: "restricted"
      enforce-version: "latest"
      audit: "restricted"
      audit-version: "latest"
      warn: "restricted"
      warn-version: "latest"
    exemptions:
      usernames: ["system:serviceaccount:kube-system:*"]
      namespaces: ["kube-system"]

name: Terraform Security Scan

on:
  push:
    paths:
      - '**.tf'

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: tfsec
        uses: aquasecurity/tfsec-action@v1.0.0
        with:
          soft_fail: false
          
      - name: checkov
        uses: bridgecrewio/checkov-action@master
        with:
          directory: ./terraform
          framework: terraform
          soft_fail: false

apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: container-alerts
  namespace: monitoring
spec:
  groups:
  - name: container.rules
    rules:
    - alert: ContainerHighCPUUsage
      expr: sum(rate(container_cpu_usage_seconds_total{container!="POD",container!=""}[5m])) by (namespace, pod, container) > 0.8
      for: 10m
      labels:
        severity: warning
      annotations:
        summary: "Container high CPU usage (namespace: {{ $labels.namespace }}, pod: {{ $labels.pod }})"
        description: "Container {{ $labels.container }} has high CPU usage for more than 10 minutes."
        
    - alert: ContainerExcessiveRestarts
      expr: increase(kube_pod_container_status_restarts_total[1h]) > 5
      for: 10m
      labels:
        severity: warning
      annotations:
        summary: "Container excessive restarts (namespace: {{ $labels.namespace }}, pod: {{ $labels.pod }})"
        description: "Container {{ $labels.container }} has restarted more than 5 times in the last hour."

## コンテナセキュリティ成熟度チェックリスト

### ビルド時セキュリティ
- [ ] ベースイメージをスリム化し、不要なパッケージを削除
- [ ] すべてのイメージに対して自動的な脆弱性スキャンを実施
- [ ] イメージに対するSBOM（ソフトウェア部品表）を生成
- [ ] CI/CDパイプラインでのセキュリティゲートを設定

### デプロイ時セキュリティ
- [ ] イメージ署名と検証の仕組みを実装
- [ ] Kubernetes PSAを使用してPodセキュリティを強制
- [ ] アドミッションコントローラーによるポリシー検証
- [ ] シークレット管理のベストプラクティスを実施

### ランタイムセキュリティ
- [ ] コンテナの挙動を監視し、異常を検知
- [ ] NetworkPolicyによる最小限の通信のみを許可
- [ ] seccompとAppArmorプロファイルの適用
- [ ] 特権昇格やコンテナエスケープの防止策