Upgrade to Pro — share decks privately, control downloads, hide ads and more …

SCAとDockerを触ってみよう!DecSecOps入門ワークショップ / SCA and Docker workshop

SCAとDockerを触ってみよう!DecSecOps入門ワークショップ / SCA and Docker workshop

ihcomega56

March 24, 2022
Tweet

More Decks by ihcomega56

Other Decks in Technology

Transcript

  1. 1
    ࣗݾ঺հ
    Α͜ͳ "ZBOB:PLPUB
    • +'SPHͷ%FWFMPQFS"EWPDBUF
    • લ৬·Ͱ͸ओʹόοΫΤϯυͷ։ൃ
    ʢ4*FS ޿ࠂձࣾ ূ݊ελʔτΞοϓʣ
    • ܹ௧ͱ໊ߴ͍੔ମʹߦͬͨ
    !"#$$%&'
    (#)*+,%-.

    View full-size slide


  2. ࠓ೔΍Δ͜ͱ
    • %PDLFSΠϝʔδΛϏϧυɾ࣮ߦ͢Δ
    • $*$%Λ࢖ͬͯΠϝʔδΛϦϙδτϦ؅ཧ͢Δʢ+'SPH
    "SUJGBDUPSZʣ
    • Πϝʔδʹର͠੬ऑੑεΩϟϯΛ࣮ߦ͢Δʢ+'SPH 9SBZʣ

    View full-size slide


  3. εςοϓ
    %PDLFSΠϝʔδΛ࡞੒࣮ͯ͠ߦ͢Δ

    View full-size slide


  4. %PDLFSGJMFͷॻ͖ํ
    FROM nginx:latest
    COPY ./index.html /usr/share/nginx/html/index.html
    ඞͣϑΝΠϧ໊͸%PDLFSGJMFͱ͢Δ
    %PDLFS͕Ϗϧυ༻ϑΝΠϧΛ໊લͰ൑ผ
    ͢ΔͨΊ

    %PDLFSGJMFͰ࢖͑Δ
    ίϚϯυ
    Ϗϧυͯ͠ΠϝʔδΛ࡞੒͢Δ
    docker build

    View full-size slide

  5. • FROM ϕʔεͱͳΔΠϝʔδΛࢦఆ͢Δ
    • RUN Ϗϧυ࣌ʹίϯςφ಺ͰίϚϯυΛ࣮ߦ͢Δ
    • ENV ,FZ7BMVFܗࣜͰ؀ڥม਺Λࢦఆ͢Δ
    • ADD, COPY Πϝʔδ಺΁ϑΝΠϧΛίϐʔ͢Δ
    ˠ<ϦϯΫ>"%%ͱ$01:جຊ͸$01:Λ࢖͏
    • CMD, ENTRYPOINT ίϯςφىಈ࣌ʹ࣮ߦ͢ΔίϚϯυ΍Ҿ਺Λ
    ͋
    ࢦఆ͢Δ
    ˠ<ϦϯΫ>$.%ͱ&/53:10*/5ͷ૊Έ߹Θͤ

    جຊతͳ%PDLFSGJMFͷίϚϯυ

    View full-size slide


  6. ΞϓϦέʔγϣϯͷίϯςφԽ
    • ݴޠ΍ϑϨʔϜϫʔΫʹΑͬͯ΍Γํ͸ͦΕͧΕ͕ͩɺࢿྉ͸
    ͨ͘͞Μ͋ΔͷͰ ࠷ۙ͸ެࣜυΩϡϝϯτ΋๛෋
    ࢀߟʹͯ͠
    ࣮ݱͰ͖Δ
    • جຊతʹ͸࣍ͷ͍ͣΕ͔ͷํ਑Ͱ%PDLFSGJMFΛॻ͍͍ͯ͘
    • ιʔείʔυΛίϯςφʹίϐʔ͠ɺΠϝʔδͷϏϧυ࣌ʹΞϓϦ
    έʔγϣϯ΋Ϗϧυ͢Δ
    • Ϗϧυͨ͠ΞϓϦέʔγϣϯͷ࣮ߦϑΝΠϧΛίϯςφʹίϐʔ͢Δ

    View full-size slide


  7. αϯϓϧΞϓϦέʔγϣϯ
    ࣮ߦ
    ϑΝΠϧ
    ιʔε
    ίʔυ
    /012345
    6789:2
    :;32<=
    Ϗϧυ͢Δ
    HSBEMFX CPPU+BS
    ࣮ߦ͢Δ
    KBWBKBSBQQIBOETPOKBS

    View full-size slide


  8. αϯϓϧΞϓϦέʔγϣϯ
    ࣮ߦ
    ϑΝΠϧ
    ΞϓϦ༻
    ίϯςφ
    ᶃίϐʔ
    ᶄίϯςφ಺Ͱ࣮ߦ
    ࣮ߦ
    ϑΝΠϧ

    View full-size slide


  9. ϋϯζΦϯλΠϜ
    • ιʔείʔυϦϙδτϦΛϑΥʔΫɺΫϩʔϯ͠Α͏
    • IUUQTHJUIVCDPNJIDPNFHB4$"BOE%PDLFS)BOET0O
    • IBOETPOϒϥϯνΛ࢖͍ͬͯ͘
    • %PDLFSGJMFΛ׬੒ͤ͞Α͏
    # TODO: アプリケーションの実⾏ファイルをコンテナ内にコピーする .
    COPY build/libs/*.jar work/app.jar .
    # TODO: アプリケーションを起動してコンテナを実⾏する .
    ENTRYPOINT ["java","-jar","/work/app.jar"] .

    View full-size slide


  10. Α͘࢖͏ίϯςφͷૢ࡞
    ίϯςφΛҰཡදࣔ͢Δ
    docker ps
    ࣮ߦ

    ఀࢭ

    ίϯςφΛఀࢭ͢Δ
    docker stop
    ίϯςφΛىಈ͢Δ
    docker start
    ࣮ߦதͷίϯςφ಺ͰίϚϯυΛ࣮ߦ͢Δ
    docker exec
    ίϯ
    ςφ
    ࣮ߦதͷίϯςφ಺ͷϩάΛग़ྗ͢Δ
    docker logs
    ίϯςφΛ࡟আ͢Δ
    docker rm
    ର৅͸ఀࢭதͷίϯςφɻ
    ಈ͍͍ͯΔ΋ͷΛࢭΊΔ࣌͸
    GΦϓγϣϯΛ͚ͭΔ
    ͪΐͬͱ͓ͨ͠ࢼ͠΍
    ௐࠪʹ࢖͏͜ͱ͕ଟ͍
    ର৅͸࣮ߦதͷίϯςφɻ
    ࢭ·͍ͬͯΔ΋ͷ΋ݟΔ࣌͸
    BΦϓγϣϯΛ͚ͭΔ

    View full-size slide

  11. ҎԼͷ͍ͣΕ͔ͰΠϝʔδΛಛఆ͢Δ
    • *%
    • Πϝʔδ໊<λά໊>
    • Πϝʔδ໊

    %PDLFSΠϝʔδͷಛఆɾ࣮ߦ
    ίϯςφΛ࡞੒ɾ࣮ߦ͢Δ
    docker run
    σϑΥϧτ͸ϑΥΞάϥ΢ϯυ
    ࣮ߦɻόοΫάϥ΢ϯυʹ͢Δ
    ʹ͸EΦϓγϣϯΛ͚ͭΔ
    ίϯςφΛ࡞੒͢Δ
    docker create
    ίϯςφΛ࣮ߦ͢Δ
    docker start

    View full-size slide


  12. ϋϯζΦϯλΠϜ
    • ΞϓϦέʔγϣϯΛϏϧυ͠Α͏
    ./gradlew bootJar
    • %PDLFSGJMFΛϏϧυ͠Α͏
    docker build -t ihcomegaws.jfrog.io/handson-docker/sample-app:latest .
    • ໊લͱλάΛ෇͚Δ <αʔόʔ><ϦϙδτϦ><໊લ><λά>
    • %PDLFSGJMFͷύεΛࢦఆʢ࣮͸࠷ޙʹυοτ͕͋Δͷʹ஫໨ʣ

    View full-size slide


  13. ϋϯζΦϯλΠϜ
    • ίϯςφΛ࣮ߦ͠Α͏
    docker run --name my-container ‒p 8888:8080
    ihcomegaws.jfrog.io/handson-docker/sample-app:latest
    • ίϯςφʹNZDPOUBJOFSͱ໊લΛ͚ͭͯىಈʢࢦఆ͠ͳ͍৔߹ɺࣗಈ
    Ͱ໊લ͕ͭ͘ʣ
    • ίϯςφͷϙʔτΛͱͯ͠ϗετଆʹެ։
    • IUUQMPDBMIPTUʹΞΫηε͠Α͏
    • มߋΛ(JUʹϓογϡ͠Α͏

    View full-size slide


  14. खݩͷ੔ཧ
    • ஈʑϩʔΧϧʹΠϝʔδ͕ͨ·͍ͬͯ͘ͷͰ࣌ʑ֬ೝ͠Α͏
    • ͍Βͳ͍΋ͷ͸࡟আ͠Α͏
    %PDLFSΠϝʔδҰཡΛදࣔ͢Δ
    docker images
    %PDLFSΠϝʔδΛ࡟আ͢Δ
    docker rmi
    >391
    ?@ABC:D
    EFGHIJ=

    View full-size slide


  15. εςοϓ
    $*$%ͰΠϝʔδΛ
    ϦϙδτϦʹอ؅͢Δ

    View full-size slide


  16. ϩʔΧϧϦϙδτϦʹอ؅
    • ࡞੒ͨ͠Πϝʔδ͸ʮόΠφϦɾϦϙδτϦϚωʔδϟʔʯʹ
    อ؅͠ɺ͔ͦ͜ΒγΣΞ΍࠶ར༻Λ͢Δ
    • ಉ͡%PDLFSGJMFΛԿ౓΋Ϗϧυ͢ΔͷΛආ͚
    ࣌ؒΛઅ໿Ͱ͖Δ
    • ඼࣭͕୲อ͞ΕͨΠϝʔδΛ࢖͍ճͤΔ
    औಘ͢Δ
    อ؅͢Δ

    View full-size slide


  17. ϦϞʔτϦϙδτϦΛհͯ͠औಘ
    • औಘͨ͠Πϝʔδ΋ʮόΠφϦɾϦϙδτϦ
    Ϛωʔδϟʔʯʹอ؅͓ͯ͘͠
    • Ωϟογϡͷ໾ׂΛՌͨ͢
    • ߴ଎ʹऔಘͰ͖Δ
    • ֎෦ϦϙδτϦʹΞΫηε
    Ͱ͖ͳͯ͘΋औಘͰ͖Δ
    औಘͭͭ͠
    อ؅͢Δ

    View full-size slide


  18. ϦϙδτϦͰΠϝʔδΛ؅ཧ
    %PDLFSΠϝʔδΛμ΢ϯϩʔυ͢Δ
    docker pull
    %PDLFSϨδετϦʹϩάΠϯ͢Δ
    docker login
    %PDLFSΠϝʔδΛݕࡧ͢Δ
    docker search
    %PDLFSΠϝʔδΛΞοϓϩʔυ͢Δ
    docker push

    View full-size slide


  19. όʔνϟϧϦϙδτϦ
    • ϩʔΧϧϦϙδτϦɾόʔνϟϧϦϙδτϦΛଋͶΔ
    • อ؅΋औಘ΋όʔνϟϧϦϙδτϦʹରͯ͠ૢ࡞͢Ε͹ྑ͍
    ϩʔΧϧ
    ϦϞʔτ
    όʔνϟϧ
    KGLM>BC
    NOHPN1QR
    S5TUV7W

    View full-size slide


  20. ϋϯζΦϯλΠϜ
    • ίϯςφΠϝʔδ༻ͷϦϙδτϦΛ࡞੒͠Α͏

    View full-size slide


  21. (JU)VC"DUJPOT
    • HJUIVCXPSLGMPXTҎԼʹઃఆϑΝΠϧΛ഑ஔ͢Δͱ࢖͑Δ
    • ·ͣ͸τϦΨʔΛࢦఆ͢Δ
    • QVTI΍13ͳͲιʔείʔυϦϙδτϦʹର͢Δૢ࡞
    • εέδϡʔϧ
    • खಈ
    • XFCIPPL
    • ࣮ߦ͕࢝ΊΒΕΕ͹ɺ͋ͱ͸΍Γ͍ͨ͜ͱΛܨ͍͛ͯ͘

    View full-size slide


  22. ϫʔΫϑϩʔͷߏ੒

    View full-size slide


  23. $*$%ͷجຊ
    • ΰʔϧͱաఔΛࢥ͍ඳ͍ͯ࡞ۀ͢Δ
    • ໋໊΍ίϝϯτͰ࣮ݱ͍ͨ͠ॲཧΛදݱ͢Δ
    • ઃఆϑΝΠϧ͸7$4Ͱ؅ཧ͢Δ
    • ύεϫʔυͷΑ͏ͳൿಗ৘ใ͸ઃఆϑΝΠϧʹॻ͔ͳ͍
    • ႈ౳ੑͷ͋Δॲཧʹ͢Δ

    View full-size slide


  24. ϋϯζΦϯλΠϜ
    • ΠϝʔδͷϏϧυɾϓογϡʹඞཁͳίϚϯυΛ׬੒ͤ͞Α͏
    docker build -t ${{ secrets.JFROG_URL }}/handson-docker/sample-
    app:latest .
    • ઌ΄Ͳͱಉ͕ͩ͡ɺ63-͸γʔΫϨοτม਺ʹ͢Δ
    jfrog c add my-jfrog-server --url=https://${{ secrets.JFROG_URL }}
    --user=${{ secrets.JFROG_USER }}
    --password=${{ secrets.JFROG_API_KEY }}
    • ʢݟ΍͢͞ͷͨΊվߦ͍ͯ͠·͕࣮͢ࡍ͸ෆཁͰ͢ʣ
    • +'SPH$-*ͷઃఆͱͯ͠ɺ+'SPHͷαʔόʔͷొ࿥ͱೝূઃఆΛߦ͏
    • Ϣʔβʔ໊ͱ"1*Ωʔ͸γʔΫϨοτม਺ʹ͢Δ

    View full-size slide


  25. ϋϯζΦϯλΠϜ
    jfrog rt dp ${{ secrets.JFROG_URL }}/handson-docker/sample-app:latest
    handson-docker --build-name=handson-build
    --build-number=${{ env.JFROG_CLI_BUILD_NUMBER }}
    --server-id=my-jfrog-server
    • ʢݟ΍͢͞ͷͨΊվߦ͍ͯ͠·͕࣮͢ࡍ͸ෆཁͰ͢ʣ
    • ΠϝʔδΛࢦఆͯ͠EPDLFS QVTI͢Δ
    • ͜͜Ͱ͸ϓογϡઌͱͯ͠όʔνϟϧϦϙδτϦΛࢦఆ͢Δ
    • +'SPHͰ͸Ϗϧυ୯ҐͰૢ࡞Λߦ͏ͨΊɺϏϧυΛಛఆ͢Δ໊લͱ൪߸
    Λ෇༩͢Δ
    • ͜͜Ͱ͸Ϗϧυͷ൪߸ʹ$-*͕ఏڙͯ͘͠ΕΔ஋Λ࠾༻͢Δ
    • αʔόʔ*%͸ઃఆͰ௥Ճͨ͠΋ͷΛࢦఆ͢Δ

    View full-size slide


  26. ϋϯζΦϯλΠϜ
    jfrog rt bce handson-build ${{ env.JFROG_CLI_BUILD_NUMBER }}
    • CVJMEJOGPʢϏϧυʹؚ·ΕΔ΋ͷ΍ґଘɺϏϧυΛߦͬͨ؀ڥͳͲ
    ͷ༷ʑͳ৘ใʣΛऩू͢Δ
    jfrog rt bp handson-build ${{ env.JFROG_CLI_BUILD_NUMBER }}
    • CVJME JOGPΛϦϙδτϦʹ൓өͤ͞Δ

    View full-size slide


  27. ϋϯζΦϯλΠϜ
    • 4FDSFUTΛઃఆ͠Α͏
    • +'30(@63-
    • +'30(@64&3
    • +'30(@"1*@,&:
    • $*$%ͷτϦΨʔΛࢦఆ͠Α͏
    • มߋͨ͠ઃఆϑΝΠϧΛϓογϡ͠Α͏

    View full-size slide


  28. εςοϓ
    Πϝʔδͷ੬ऑੑεΩϟϯΛߦ͏

    View full-size slide


  29. ϙϦγʔɺϧʔϧɺ΢Υον
    ϙϦγʔ
    ϧʔϧ
    ϧʔϧ
    ϧʔϧ
    ϧʔϧ
    ΢Υον

    View full-size slide


  30. ϙϦγʔɺϧʔϧɺ΢Υον
    • ϧʔϧݕ஌͢Δ੬ऑੑͷϨϕϧɺ੬ऑੑ͕ݟ͔ͭͬͨͱ͖ͷ
    ΞΫγϣϯʢ௨஌ํ๏΍$*$%΁ͷӨڹͳͲʣΛఆٛ͢Δ
    • ϙϦγʔϧʔϧΛଋͶͨ΋ͷ
    • ΢ΥονϙϦγʔͱεΩϟϯର৅ʢϦϙδτϦ΍ϏϧυʣΛ
    ඥ෇͚Δ

    View full-size slide


  31. ϋϯζΦϯλΠϜ
    • ੬ऑੑεΩϟϯͷઃఆΛ͠Α͏
    • 9SBZΛ༗ޮʹ͢Δ
    • ϏϧυΛΠϯσοΫε͢Δ
    • ϙϦγʔɺϧʔϧɺ΢ΥονΛ࡞੒͢Δ
    • ΠϝʔδΛεΩϟϯ͠Α͏
    jfrog rt bs handson-build ${{ env.JFROG_CLI_BUILD_NUMBER }}
    • εΩϟϯ݁ՌΛ֬ೝ͠Α͏

    View full-size slide


  32. ϋϯζΦϯλΠϜ
    • ϥΠϒϥϦͷόʔδϣϯΛ্͛ͯ࠶౓ϏϧυΛ࣮ߦ͠ɺ݁ՌΛ
    ֬ೝ͠Α͏
    • 4#0.ΛݟͯΈΑ͏ʢແྉͩͱ࢖͑ͳ͍ͨΊΑ͜ͳ͕͓ݟͤ͠·͢ʣ

    View full-size slide