Container Security with Trivy

Transcript

1. ίϯςφηΩϡϦςΟπʔϧ 5SJWZͷ঺հ ౻ଜ
   ڡ߂
   ʢ೥ʣ
2. ໨࣍ w ࣗݾ঺հ
   w ҆શͳίϯςφͱ͸
   w ίϯςφεΩϟφπʔϧ
   w 5SJWZͷ঺հ
   w 5SJWZͷ࢓૊Έʹ͍ͭͯ
3. ࣗݾ঺հ
4. ౻ଜ ڡ߂ # Trivy/helmͷίϯτϦϏϡʔλ Github: @masahiro331
5. ࠓճͷ࿩ͷഎܠ ίϯςφΞϓϦέʔγϣϯͷ 
 ੬ऑੑΛ؅ཧ҆͠શʹ͍ͨ͠
6. ຊ୊
7. ҆શͳίϯςφͱ͸ʁ
8. ৴པ͞Εͨݸਓஂମ͕อक
   ҆શͳύοέʔδΛར༻
9. ৴པ͞Εͨݸਓஂମ͕อक
   ҆શͳύοέʔδΛར༻
10. ίϯςφ಺Ͱར༻͞ΕΔύοέʔδ w 04ύοέʔδ 
 31.ύοέʔδ
    EFCύοέʔδ
    FUD
    
    w ΞϓϦέʔγϣϯύοέʔδ 
 OQNύοέʔδ
    HFNύοέʔδ
    FUD
11. ίϯςφ಺Ͱར༻͞ΕΔύοέʔδ w 04ύοέʔδ 
 31.ύοέʔδ
    EFCύοέʔδ
    FUD
    
    w ΞϓϦέʔγϣϯύοέʔδ 
 OQNύοέʔδ
    HFNύοέʔδ
    FUD ͜ΕΒͷύοέʔδʹ੬ऑੑ͕ແ͍͔ɺ 
 ΋͘͠͸Өڹ͠ͳ͍͜ͱ൑அ͢Δඞཁ͕͋Δ
12. ύοέʔδͷ੬ऑੑΛೝࣝ͢Δඞཁ͕͋Δ ͦͷͨΊʹ͸
13. ύοέʔδͷ੬ऑੑΛೝࣝ͢Δඞཁ͕͋Δ ίϯςφεΩϟϯπʔϧͰ੬ऑੑͷࣗಈݕ஌ ͦͷͨΊʹ͸
14. ίϯςφͷεΩϟϯπʔϧҰཡ w 5SJWZ
    
    w $MBJS
    w "ODIPSF
    &OHJOF
    
    w 2VBZ
    
    w .JDSP4DBOOFS
    w %PDLFS
    )VC
    w ($3
15. ίϯςφεΩϟϯπʔϧͱͯ͠5SJWZΛ࠾༻
16. 5SJWZͱ͸ w LORZGࢯ͕։ൃͨ͠ίϯς φεΩϟϯπʔϧ
    w ଞͷεΩϟϯπʔϧͱൺֱͯ͠ ಋೖ͕༰қ
    w ΞϓϦέʔγϣϯύοέʔδͷ ੬ऑੑݕ஌΋Մೳ
    w ಠࣗͷํ๏Ͱ"MQJOFͷ੬ऑੑΛ ݕ஌͍ͯ͠ΔͨΊਫ਼౓͕ߴ͍ LORZGࢯ
17. ֤εΩϟϯπʔϧͷݕূ݁Ռ ࢀߟ৘ใ
    IUUQTHJUIVCDPNLORZGUSJWZPWFSWJFX
18. ֤εΩϟϯπʔϧͷݕূ݁Ռ ࢀߟ৘ใ
    IUUQTHJUIVCDPNLORZGUSJWZPWFSWJFX ΞϓϦέʔγϣϯ ύοέʔδ΋ΈΕΔ
19. 5SJWZͷରԠύοέʔδ w (FN fi MFMPDL
    SVCZ
    w 1JQ fi MFMPDL
    QZUIPO
    w 1PFUSZMPDL
    QZUIPO
    w $PNQPTFSMPDL
    
    1)1
    w 1BDLBHFMPDLKTPO
    KBWBTDSJQU
    w ZBSOMPDL
    KBWBTDSJQU
    w $BSHPMPDL
    3VTU
20. ֤εΩϟϯπʔϧͷݕূ݁Ռ ࢀߟ৘ใ
    IUUQTHJUIVCDPNLORZGUSJWZPWFSWJFX ಋೖ͕༰қ
21. 5SJWZͷಋೖ
22. 5SJWZͷ࢖͍ํ
23. ֤εΩϟϯπʔϧͷݕূ݁Ռ ࢀߟ৘ใ
    IUUQTHJUIVCDPNLORZGUSJWZPWFSWJFX ݕ஌ਫ਼౓͕ߴ͍
24. ֤εΩϟϯπʔϧͷݕূ݁Ռ ࢀߟ৘ใ
    IUUQTHJUIVCDPNLORZGUSJWZPWFSWJFX $*্Ͱ࢖͍΍͍͢
25. 5SJWZͷ࢓૊Έʹ͍ͭͯ঺հ
26. 5SJWZͷߏ੒ %PDLFS
    3FHJTUSZ ᶅ
    ੬ऑੑݕ஌ ੬ऑੑ%# ᶃ
    ੬ऑੑ৘ใͷऔಘ ᶄ
    %PDLFS-BZFSΛऔಘ͠
    *NBHFΛ૊ΈཱͯΔ
27. ੬ऑੑ%# %PDLFS
    3FHJTUSZ ᶃ
    ੬ऑੑ৘ใͷऔಘ ᶅ
    ੬ऑੑݕ஌ ੬ऑੑ%#ʹ͍ͭͯ ᶄ
    %PDLFS-BZFSΛऔಘ͠
    *NBHFΛ૊ΈཱͯΔ
28. ੬ऑੑ%#ʹ͍ͭͯ w ੬ऑੑ৘ใ͸HJUIVCϦϙδτϦͰ؅ཧ͍ͯ͠Δ
    w 5SJWZ͸ॳճىಈ࣌ʹ੬ऑੑ৘ใΛDMPOF͢Δ
    w ࣍ճىಈҎ߱͸HJUͷࠩ෼Ξοϓσʔτ
    w ϩʔΧϧͷσʔλϕʔεͱͯ͠CCPMU%#Λ࢖༻
29. ॳճ࣮ߦ࣌ʹHJUIVC͔Β੬ऑੑ৘ใΛऔಘ ੬ऑੑϦϙδτϦ $BDIFWVMOMJTU HJU
    DMPOF
30. ࣍ճҎ߱͸HJU
    QVMMͰͷࠩ෼ߋ৽ ੬ऑੑϦϙδτϦ $BDIFWVMOMJTU HJU
    QVMM
31. ੬ऑੑ৘ใ͸$JSDMF$*Ͱఆظߋ৽ ੬ऑੑϦϙδτϦ $BDIFWVMOMJTU $SPO+PCͰͷߋ৽ ੬ऑੑσʔλιʔε 5SBWJT
    $*
32. HJUϦϙδτϦΛܦ༝͢Δཧ༝ w ੬ऑੑσʔλιʔε 3FE
    )BU
    4FDVSJUZ
    %BUB ͳͲ ͷλΠϜΞ΢τ͕ϢʔβʹӨڹ͢ΔͷΛΛ๷͙ͨΊ
    w ߋ৽σʔλΛࠩ෼Ξοϓσʔτ͢Δ͜ͱ͕Մೳ
33. %PDLFS*NBHFͷղੳʹ͍ͭͯ
34. ੬ऑੑ%# %PDLFS
    3FHJTUSZ ᶃ
    ੬ऑੑ৘ใͷऔಘ ᶅ
    ੬ऑੑݕ஌ %PDLFS*NBHFͷղੳʹ͍ͭͯ ᶄ
    %PDLFS-BZFSΛऔಘ͠
    *NBHFΛ૊ΈཱͯΔ
35. %PDLFS*NBHFͷղੳʹ͍ͭͯ w 5SJWZ͸ҎԼͷεςοϓͰ%PDLFS*NBHFΛղੳ
     %PDLFS
    3FHJTUSZ͔Β*NBHF
    -BZFSΛऔಘ
     *NBHF
    -BZFSΛ૊ΈཱͯͯϑΝΠϧΛऔΓग़͢
     ੬ऑੑݕ஌ʹඞཁͳϑΝΠϧΛऔಘ ECJOTUBMMFE (FN fi MFMPDLͳͲ 
 w "MQJOFʹ͍ͭͯ͸36/ίϚϯυ΋ղੳ͢ΔͨΊελςΟοΫϦ ϯΫ͞ΕͨϥΠϒϥϦͷ੬ऑੑ΋ݕ஌
36. '30.
    DPNQPTFSBMQJOF
    "%%
    DPNQPTFSMPDL
    QIQBQQDPNQPTFSMPDL
    $.%
    <CJOCBTI>
    ྫ͑͹͜Μͳ%PDLFS fi MF
37. *NBHF-BZFSΛऔಘ͢Δ '30.
    DPNQPTFS "%%
    DPNQPTFSMPDL 36/
    CJOCBTI
38. *NBHF-BZFSΛੵΈॏͶ*NBHFΛ࡞੒ %PDLFS
    *NBHF '30.
    DPNQPTFS "%%
    DPNQPTFSMPDL 36/
    CJOCBTI
39. *NBHF͔Βొ࿥ͨ͠ϑΝΠϧΛऔΓग़͢ %PDLFS
    *NBHF $PNQPTFSMPDL BMQJOFSFMFBTF ECJOTUBMMFE '30.
    DPNQPTFS "%%
    DPNQPTFSMPDL 36/
    CJOCBTI
40. ੬ऑੑ%# %PDLFS
    3FHJTUSZ ᶃ
    ੬ऑੑ৘ใͷऔಘ ᶅ
    ੬ऑੑݕ஌ ੬ऑੑݕ஌ʹ͍ͭͯ ᶄ
    %PDLFS-BZFSΛऔಘ͠
    *NBHFΛ૊ΈཱͯΔ
41. (FN fi MFMPDL ΠϯετʔϧࡁΈύοέʔδΛύʔε (&.
    
    
    SFNPUF
    IUUQTSVCZHFNTPSH
    
    
    TQFDT
    
    
    
    
    BDUJPODBCMF
    
    
    
    
    
    
    
    BDUJPOQBDL
    
    
    
    
    
    
    
    
    OJPS
    d
    
    
    
    
    
    
    
    XFCTPDLFUESJWFS
    
    
    
    
    
    
    BDUJPONBJMFS
    
    
    
    
    
    
    
    BDUJPOQBDL
    
    
    
    
    
    
    
    
    BDUJPOWJFX
    
    
    
    
    
    
    
    
    BDUJWFKPC
    
    
    
    
    
    
    
    
    NBJM
    d
    
    
    
    
    
    
    
    
    
    SBJMTEPNUFTUJOH
    d
     1JQ fi MFMPDL BNRQ
    \
    
    
    
    
    
    
    
    
    
    
    
    
    IBTIFT
    <
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    TIBCFC
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    TIBBCD
    
    
    
    
    
    
    
    
    
    
    
    
    >
    
    
    
    
    
    
    
    
    
    
    
    
    WFSTJPO
    
    
    
    
    
    
    
    
    
    ^
    
    
    
    
    
    
    
    
    BVUPQFQ
    \
    
    
    
    
    
    
    
    
    
    
    
    
    IBTIFT
    <
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    TIBECC
    
    
    
    
    
    
    
    
    
    
    
    
    >
    
    
    
    
    
    
    
    
    
    
    
    
    WFSTJPO
    
    
    
    
    
    
    
    
    
    ^ $2C[FL,/CH/R6K$S%+LPH71%H
    1MJCTTM
    7DS
    "Y@
    4
    *
    544-
    TIBSFE
    MJCSBSJFT
    6IUUQTXXXPQFOTTMPSH
    -0QFO44-
    PPQFOTTM
    N5JNP
    5FSBT
    UJNPUFSBT!JLJ fi 
    U
    DCCCCDEDBCCFFFCC
    %TPMJCDNVTMY@TP
    TPMJCDSZQUPTP
    QTPMJCTTMTP
    SMJCSFTTM
    'MJC
    3MJCTTMTP
    B
    ;24I29.-(31(CR%Q8;/-Y/N#V5
    'VTS
    'VTSMJC
    3MJCTTMTP
    B
    ;2KQFZQ)0H.JIXM(1NND ECJOTUBMMFE
42. ੬ऑੑ%#͔Βऔಘͨ͠σʔλͱಥ߹ (FN fi MFMPDL (&.
    
    
    SFNPUF
    IUUQTSVCZHFNTPSH
    
    
    TQFDT
    
    
    
    
    BDUJPODBCMF
    
    
    
    
    
    
    
    BDUJPOQBDL
    
    
    
    
    
    
    
    
    OJPS
    d
    
    
    
    
    
    
    
    XFCTPDLFUESJWFS
    
    
    
    
    
    
    BDUJPONBJMFS
    
    
    
    
    
    
    
    BDUJPOQBDL
    
    
    
    
    
    
    
    
    BDUJPOWJFX
    
    
    1JQ fi MFMPDL BNRQ
    \
    
    
    
    
    
    
    
    
    
    
    
    
    IBTIFT
    <
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    TIBCFC
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    TIBBCD
    
    
    
    
    
    
    
    
    
    
    
    
    >
    
    
    
    
    
    
    
    
    
    
    
    
    WFSTJPO
    
    
    
    
    
    
    
    
    
    ^
    
    
    
    
    
    
    
    
    BVUPQFQ
    \
    $2C[FL,/CH/R6K$S%+LPH71%H
    1MJCTTM
    7DS
    "Y@
    4
    *
    544-
    TIBSFE
    MJCSBSJFT
    6IUUQTXXXPQFOTTMPSH
    -0QFO44-
    PPQFOTTM
    N5JNP
    5FSBT
    UJNPUFSBT!JLJ fi 
    U
    DCCCCDEDBCCFFFC C
    %TPMJCDNVTMY@TP
    TPMJCDSZQUPTP
    QTPMJCTTMTP
    SMJCSFTTM
    'MJC
    3MJCTTMTP
    ECJOTUBMMFE ੬ऑੑ৘ใ
43. ࠷ޙʹ w 5SJWZ͸γϯϓϧͳ੬ऑੑݕ஌͚ͩΛఏڙ
    w ͜ͷػೳΛར༻ͯ͠৽ͨͳ%FW4FD0QTπʔ ϧͷ։ൃͳͲ΋ظ଴Ͱ͖Δ
    w ͜ͷػೳΛར༻ͯ͠LVCFSOFUFT؀ڥͷ੬ऑੑ ݕ஌ΛࣗಈԽ͍ͨ͠
44. ͓ΘΓ