Upgrade to Pro — share decks privately, control downloads, hide ads and more …

container-breakout

 container-breakout

2021/06/22 Kubernetes Novice Tokyo #11
コンテナを突き破れ!!〜コンテナセキュリティ入門基礎の基礎〜

mochizuki875

June 22, 2021
Tweet

More Decks by mochizuki875

Other Decks in Technology

Transcript

  1. ૝ఆγφϦΦ ❯❯❯ kubectl get po NAME READY STATUS RESTARTS AGE

    web-back 1/1 Running 1 20d database 1/1 Running 0 6d2h ubuntu 1/1 Running 0 25d web-front 1/1 Running 0 5d4h ,VCFSOFUFT্Ͱίϯςφʢ1PEʣ͕ಈ͍͍ͯΔͱ͠·͢ɻ ͋Δίϯςφʹ߈ܸऀ͕৵ೖͯ͠TIFMMΛऔಘ͞Εͨͱ૝ఆ͠·͢ɻ ˠʮίϯςφ͸ଞ͔Βִ཭͞Ε͍ͯΔʯͷͰ҆৺ɾɾɾͰ͢ΑͶʁʁ $POUBJOFS)PTUʢ8PSLFS/PEFʣ XFCGSPOU XFCCBDL EBUBCBTF VCVOUV "UUBDL Өڹ͕͋Δͷ͸ ͜ͷίϯςφ͚ͩͷ͸ͣɾɾɾ CJOCBTI
  2. $POUBJOFS#SFBLPVU ৵ೖͨ͠ίϯςφ͔Β8PSLFS/PEFͰ೚ҙͷίϚϯυΛ࣮ߦ͢Δ͜ͱΛࢼΈ·͢ɻ ͜ͷΑ͏ʹίϯςφͷִ཭؀ڥ͔Βίϯςφ֎ʢϗετͳͲʣʹӨڹΛٴ΅͢ࣄΛ $POUBJOFS#SFBLPVUͱݺͼ·͢ɻ ˠ͜Ε͕Ͱ͖Ε͹΍Γ͍ͨ์୊ʂʂ $POUBJOFS)PTUʢ8PSLFS/PEFʣ VCVOUV "UUBDL CJOCBTI DNE

    ίϯςφ͔Βϗετ্Ͱ೚ҙͷ ίϚϯυΛ࣮ߦ XFCGSPOU XFCCBDL EBUBCBTF ଞͷίϯςφ΁ͷ ߈ܸ΋Մೳ ΍ͬͨͥʂʂ ˞ࠓճ͸ର৅ͷίϯςφʹ͋ΔઃఆෆඋΛ࢓ࠐΜͰ͓Γɺͦ͜Λಥ͍ͯ߈ܸΛߦ͍·͢ɻ ɹʢܾͯ͠ಛघͳ΋ͷͰ͸ແ͍ͷͰҎ߱ͷ߈ܸखॱΛݟͳ͕ΒͲ͕͜Ϡό͍͔Ұॹʹߟ͑ͯΈ͍ͯͩ͘͞ʂʣ Կ͔͠ΒͷखஈͰίϯςφʹ ৵ೖͰ͖ͨͱ͠·͢
  3. NPVOUcHSFQPWFSMBZ PWFSMBZPOUZQFPWFSMBZ SX SFMBUJNF MPXFSEJSWBSMJCDPOUBJOFSEJPDPOUBJOFSETOBQTIPUUFSWPWFSMBZGT TOBQTIPUTGTWBSMJCDPOUBJOFSEJPDPOUBJOFSETOBQTIPUUFSWPWFSMBZGTTOBQTIPUTGTWBSMJC DPOUBJOFSEJPDPOUBJOFSETOBQTIPUUFSWPWFSMBZGTTOBQTIPUTGT VQQFSEJSWBSMJCDPOUBJOFSE JPDPOUBJOFSETOBQTIPUUFSWPWFSMBZGTTOBQTIPUTGT XPSLEJSWBSMJCDPOUBJOFSE

    JPDPOUBJOFSETOBQTIPUUFSWPWFSMBZGTTOBQTIPUTXPSL YJOPP ff ʢίϯςφʣ $POUBJOFS)PTUʢ8PSLFS/PEFʣ VCVOUV TZTGTDHSPVQSENB Y ࣮ࡍʹ͸ϗετ্ͷ 0WFSMBZGTʹଘࡏ 6QQFSEJS -PXFSEJS -BZFS -PXFSEJS -BZFS XPSL 0WFSMBZGT DNE DNE *NNVUBCMF-BZFS มߋࠩ෼ ίϯςφͷSPPUGT͸ϗετ্ͷ0WFSMBZGT͔ΒϚ΢ϯτ͞Ε͓ͯΓɺίϯςφ্Ͱ࡞੒ͨ͠ϑΝΠ ϧDNE͸࣮ࡍʹ͸ϗετ্ͷ0WFSMBZGTʢมߋࠩ෼͕֨ೲ͞ΕΔ6QQFSEJS্ʣʹଘࡏ͠·͢ɻ Ϛ΢ϯτ͞Ε͍ͯΔ0WFSMBZGTͷϗετ্Ͱͷύε͸ɺίϯςφ಺ͰNPVOUίϚϯυΛ࣮ߦ͢Δ͜ ͱͰ֬ೝՄೳͰ͢ɻ OPUJGZ@PO@SFMFBTF $POUBJOFS#SFBLPVU
  4. FDIPWBSMJCDPOUBJOFSEJPDPOUBJOFSETOBQTIPUUFSWPWFSMBZGTTOBQTIPUTGTDNETZTGT DHSPVQSENBSFMFBTF@BHFOU ʢίϯςφʣ $POUBJOFS)PTUʢ8PSLFS/PEFʣ VCVOUV TZTGTDHSPVQSENB Y 6QQFSEJS -PXFSEJS -BZFS

    -PXFSEJS -BZFS XPSL 0WFSMBZGT DNE ొ࿥ SFMFBTF@BHFOU VQQFSEJSDNE͸ϗετ͔Βݟ࣮ͨߦՄೳͳύεͱͳΔͨΊɺSFMFBTF@BHFOUʹొ࿥͓ͯ͘͠ࣄͰ ର৅DHSPVQʢOPUJGZ@PO@SFMFBTFΛʹઃఆͨ͠DHSPVQʣʹॴଐ͢Δϓϩηε͕ऴྃͨ͠ࡍʹ ࣮ߦ͞ΕΔࣄʹͳΓ·͢ɻ ͜ΕͰ߈ܸͷ४උ͕੔͍·ͨ͠ɻ OPUJGZ@PO@SFMFBTF $POUBJOFS#SFBLPVU FDIP ࣮ߦϓϩάϥϜͱͯ͠ࢦఆ
  5. TIDFDIPaaTZTGTDHSPVQSENBYDHSPVQQSPDT ʢίϯςφʣ $POUBJOFS)PTUʢ8PSLFS/PEFʣ VCVOUV TZTGTDHSPVQSENB Y OPUJGZ@PO@SFMFBTF 6QQFSEJS -PXFSEJS -BZFS

    -PXFSEJS -BZFS XPSL 0WFSMBZGT DNE ొ࿥͞ΕͨϓϩάϥϜ͕࣮ߦ SFMFBTF@BHFOU ࣮ࡍʹ߈ܸ͠·͢ɻ VQQFSEJSDNEΛSFMFBTFBHFOUΛ࢖࣮ͬͯߦͤ͞ΔͨΊʹɺҎԼͷίϚϯυʹΑΓ 1*%ΛDHSPVQ TZTGTDHSPVQSENBY ʹొ࿥͠·͢ɻ ίϚϯυ࣮ߦ͕׬ྃ͢ΔͱDHSPVQʹઃఆͨ͠ϓϩηε͕ଘࡏ͠ͳ͍͜ͱʹͳΓSFMFBTF@BHFOUʹ ొ࿥ͨ͠ϓϩάϥϜ͕ൃՐ͠·͢ɻ DHSPVQQSPDT QSPDFTT TI ίϚϯυ࣮ߦ࣌ʹ1*%͕ొ࿥͞Ε ׬ྃʹ൐͍࡟আ͞ΕΔ ίϯςφ಺ͰίϚϯυΛ࣮ߦ ಺෦ʹهࡌͨ͠ίϚϯυ͕ ϗετ্Ͱ࣮ߦ $POUBJOFS#SFBLPVU
  6. ʢίϯςφଆͰ༻ҙͨ͠ϓϩάϥϜ࠶ܝʣ ίϯςφଆͰ༻ҙͨ͠ϓϩάϥϜ͕ϗετଆͰ࣮ߦ͞Εɺهࡌͨ͠ίϚϯυ͕࣮ߦ͞Ε͍ͯΔ͜ͱΛ֬ೝ͠· ͢ɻࠓճ͸ҎԼͷΑ͏ʹϗετଆʹϑΝΠϧΛ࡞੒͠ɺϝοηʔδΛग़ྗ͢ΔίϚϯυΛϓϩάϥϜ಺Ͱఆٛ ͠·ͨ͠ɻ ϗετଆͰ֬ೝ͢Δͱίϯςφ಺Ͱ༻ҙͨ͠ϓϩάϥϜ͕࣮ߦ͞Εɺϝοηʔδ͕ग़ྗ͞Ε͍ͯΔ͜ͱ͕෼͔Γ ·͢ɻ SPPU!VCVOUVLTXPSLFSdDBUUNQPVUQVU IPTUOBNF$PNNBOEGSPN$POUBJOFS VCVOUVLTXPSLFS ʢϗετʣ

    DBU&0'DNE CJOTI FDIPIPTUOBNF$PNNBOEGSPN$POUBJOFSUNQPVUQVU IPTUOBNFUNQPVUQVU &0' ྫ͑͹ҎԼͷΑ͏ͳϓϩάϥϜΛίϯςφͰ༻ҙ࣮ͯ͠ߦͨ͠৔߹ɺίϯςφ͔Βϗετ্ͷશͯͷϑΝΠϧʹ ΞΫηεग़དྷΔ༷ʹͳΓ·͢ɻʢྫ͑͹͜ͷঢ়ଶͰ$3*ιέοτʹΞΫηε͢Ε͹ίϯςφͷૢ࡞΋Մೳʣ DBU&0'DNE CJOTI MOTWBSMJCDPOUBJOFSEJPDPOUBJOFSETOBQTIPUUFSWPWFSMBZGTTOBQTIPUTGTIPTUSPPU &0' $POUBJOFS#SFBLPVU
  7. ʢίϯςφଆͰ༻ҙͨ͠ϓϩάϥϜ࠶ܝʣ SPPU!VCVOUVLTXPSLFSdDBUUNQPVUQVU IPTUOBNF$PNNBOEGSPN$POUBJOFS VCVOUVLTXPSLFS ʢϗετʣ DBU&0'DNE CJOTI FDIPIPTUOBNF$PNNBOEGSPN$POUBJOFSUNQPVUQVU IPTUOBNFUNQPVUQVU &0'

    ྫ͑͹ҎԼͷΑ͏ͳϓϩάϥϜΛίϯςφͰ༻ҙ࣮ͯ͠ߦͨ͠৔߹ɺίϯςφ͔Βϗετ্ͷશͯͷϑΝΠϧʹ ΞΫηεग़དྷΔ༷ʹͳΓ·͢ɻʢྫ͑͹͜ͷঢ়ଶͰ$3*ιέοτʹΞΫηε͢Ε͹ίϯςφͷૢ࡞΋Մೳʣ DBU&0'DNE CJOTI MOTWBSMJCDPOUBJOFSEJPDPOUBJOFSETOBQTIPUUFSWPWFSMBZGTTOBQTIPUTGTIPTUSPPU &0' $POUBJOFS#SFBLPVU ίϯςφଆͰ༻ҙͨ͠ϓϩάϥϜ͕ϗετଆͰ࣮ߦ͞Εɺهࡌͨ͠ίϚϯυ͕࣮ߦ͞Ε͍ͯΔ͜ͱΛ֬ೝ͠· ͢ɻࠓճ͸ҎԼͷΑ͏ʹϗετଆʹϑΝΠϧΛ࡞੒͠ɺϝοηʔδΛग़ྗ͢ΔίϚϯυΛϓϩάϥϜ಺Ͱఆٛ ͠·ͨ͠ɻ ϗετଆͰ֬ೝ͢Δͱίϯςφ಺Ͱ༻ҙͨ͠ϓϩάϥϜ͕࣮ߦ͞Εɺϝοηʔδ͕ग़ྗ͞Ε͍ͯΔ͜ͱ͕෼͔Γ ·͢ɻ ΍ͬͨͥʂʂ 😜
  8. Կ͕͍͚ͳ͔ͬͨͷ͔ʁʁ ݁࿦͔Βݴ͏ͱίϯςφʹಛݖΛ෇༩ͯ͠͠·͍ͬͯͨ͜ͱ͕ݪҼͰ͢ɻ ࣮͸ࠓճ߈ܸର৅ʹͳͬͨίϯςφ͸ɺҎԼͷΑ͏ͳઃఆͰಈ͔͍ͯ͠·ͨ͠ɻ ͜ΕʹΑΓίϯςφ಺ͷϓϩηε͸ϗετ্ͷSPPUϢʔβʔʢ6*%ʣͱಉ౳ͷ ݖݶΛ༗͢Δ͜ͱʹͳΓɺDHSPVQΛૢ࡞ͨ͠Γϗετ಺Ͱ೚ҙͷίϚϯυΛ ࣮ߦͰ͖·ͨ͠ɻ BQJ7FSTJPOW LJOE1PE NFUBEBUB MBCFMT

    SVOVCVOUV OBNFVCVOUV TQFD DPOUBJOFST JNBHFVCVOUV OBNFVCVOUV DPNNBOE<CJOCBTI> BSHT<D UBJMGWBSMPHBMUFSOBUJWFTMPH> TFDVSJUZ$POUFYU QSJWJMFHFEUSVF VCVOUVQSJWJMFHFEZNM ίϯςφΛಛݖͰಈ࡞ TFDVSJUZ$POUFYUͰ͸1PEىಈʹ͓͚Δ༷ʑͳ ηΩϡϦςΟ߲໨Λઃఆ͢Δ͜ͱ͕Ͱ͖·͢ɻ ࠓճ͸TFDVSJUZ$POUFYUͰίϯςφΛಛݖͰಈ࡞ͤ͞ ΔΦϓγϣϯΛ༗ޮԽ͍ͯ͠·ͨ͠ɻ ˞ҼΈʹࠓճ͸ίϯςφͷ࣮ߦϢʔβʔΛSPPUͱ͍ͯ͠·͢ɻ ɹίϯςφͷηΩϡϦςΟతʹ͜Ε΋͋·Γྑ͍ͱ͞ΕΔࣄͰ͸ ɹͳ͍ͷͰ͕͢ɺࠓճͷ࿩ͷຊ࣭Ͱ͸ແ͍ͨΊ͜͜ʹ͸৮Ε·ͤΜ 
 ɹʢҰൠతʹ6TFS/BNFTQBDFΛϗετͱڞ༗͍ͯ͠Δ৔߹ʣ
  9. Կ͕͍͚ͳ͔ͬͨͷ͔ʁʁ ಛݖίϯςφͱඇಛݖίϯςφͰDHSPVQ΁ͷΞΫηεݖΛൺֱ͢Δͱɺ ඇಛݖίϯςφͰ͸3FBE0OMZʢ30ʣͰ͋Δͷʹରͯ͠ಛݖίϯςφͰ͸ 3FBE8SJUFʢ38ʣʹͳ͍ͬͯΔ͜ͱ͕෼͔Γ·͢ɻ SPPU!VCVOUVOPOQSJWJMFHFENPVOUcHSFQDHSPVQ ʢུʣ DHSPVQPOTZTGTDHSPVQNFNPSZUZQFDHSPVQ SP OPTVJE OPEFW

    OPFYFD SFMBUJNF NFNPSZ  DHSPVQPOTZTGTDHSPVQQJETUZQFDHSPVQ SP OPTVJE OPEFW OPFYFD SFMBUJNF QJET  DHSPVQPOTZTGTDHSPVQDQV DQVBDDUUZQFDHSPVQ SP OPTVJE OPEFW OPFYFD SFMBUJNF DQV DQVBDDU  DHSPVQPOTZTGTDHSPVQSENBUZQFDHSPVQ SP OPTVJE OPEFW OPFYFD SFMBUJNF SENB  ʢུʣ ʢඇಛݖίϯςφʣ ɹ௨ৗίϯςφͰ͸DHSPVQ΁ͷΞΫηεݖ͸30ʹઃఆ͞Ε·͢ SPPU!VCVOUVNPVOUcHSFQDHSPVQ ʢུʣ DHSPVQPOTZTGTDHSPVQNFNPSZUZQFDHSPVQ SX OPTVJE OPEFW OPFYFD SFMBUJNF NFNPSZ  DHSPVQPOTZTGTDHSPVQQJETUZQFDHSPVQ SX OPTVJE OPEFW OPFYFD SFMBUJNF QJET  DHSPVQPOTZTGTDHSPVQDQV DQVBDDUUZQFDHSPVQ SX OPTVJE OPEFW OPFYFD SFMBUJNF DQV DQVBDDU  DHSPVQPOTZTGTDHSPVQSENBUZQFDHSPVQ SX OPTVJE OPEFW OPFYFD SFMBUJNF SENB  ʢུʣ ʢಛݖίϯςφʣ ࠓճͷέʔεͰ͸ಛݖΛ༩͑ͨ͜ͱʹΑΓDHSPVQ΁ͷΞΫηεݖ͕38ʹઃఆ͞Ε·ͨ͠