# Attack surface comparison
FROM debian:bookworm    # ~800 packages, ~120MB, ~50 CVEs typical
FROM python:3.12-slim   # ~100 packages, ~130MB, ~15 CVEs typical  
FROM python:3.12-alpine # ~30 packages, ~50MB, ~5 CVEs typical
FROM scratch            # 0 packages, ~0MB, 0 CVEs (static binary only)

# Pin exact versions for reproducibility
FROM node:20.10.0-alpine3.19 AS builder
WORKDIR /app
 
# Copy dependency files with minimal context
COPY package.json package-lock.json ./
 
# Install production dependencies only
RUN npm ci --omit=dev && \
    # Remove npm cache
    npm cache clean --force && \
    # Remove unnecessary files
    rm -rf /tmp/*
 
FROM node:20.10.0-alpine3.19 AS production
 
# Install security updates and tini for init process
RUN apk update && \
    apk upgrade && \
    apk add --no-cache tini && \
    rm -rf /var/cache/apk/*
 
# Create non-root user with explicit IDs
RUN addgroup -g 1001 -S appgroup && \
    adduser -S -u 1001 -G appgroup -h /app appuser
 
WORKDIR /app
 
# Copy application with correct ownership
COPY --from=builder --chown=appuser:appgroup /app/node_modules ./node_modules
COPY --chown=appuser:appgroup package.json ./
COPY --chown=appuser:appgroup src/ ./src/
 
# Remove setuid/setgid permissions from all binaries
RUN find / -type f \( -perm /4000 -o -perm /2000 \) -exec chmod ug-s {} \; 2>/dev/null || true
 
# Switch to non-root user
USER 1001:1001
 
# Use tini as PID 1 for proper signal handling
ENTRYPOINT ["/sbin/tini", "--"]
 
EXPOSE 3000
 
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
  CMD wget --no-verbose --tries=1 --spider http://localhost:3000/health || exit 1
 
CMD ["node", "src/index.js"]

# docker-compose.yml with comprehensive security hardening
version: '3.8'
 
services:
  api:
    build:
      context: .
      target: production
    ports:
      - "3000:3000"
    
    # Filesystem security
    read_only: true
    tmpfs:
      - /tmp:size=100M,noexec,nosuid,nodev
      - /app/.cache:size=50M
    
    # Process security
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    
    # Resource limits
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 512M
          pids: 100
        reservations:
          cpus: '0.25'
          memory: 256M
    
    # Health monitoring
    healthcheck:
      test: ["CMD", "wget", "--spider", "http://localhost:3000/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    
    # Logging
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "5"
    
    # Network isolation
    networks:
      - backend
    
    # Restart policy
    restart: unless-stopped
 
  db:
    image: postgres:16.1-alpine3.19
    read_only: true
    tmpfs:
      - /tmp:size=100M
      - /var/run/postgresql:size=10M
    volumes:
      - pgdata:/var/lib/postgresql/data
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
      - FOWNER
      - SETGID
      - SETUID
      - NET_BIND_SERVICE
    networks:
      - backend
    environment:
      - POSTGRES_PASSWORD_FILE=/run/secrets/db_password
    secrets:
      - db_password
 
  redis:
    image: redis:7.2-alpine3.19
    read_only: true
    command: >
      redis-server
      --requirepass ${REDIS_PASSWORD}
      --protected-mode yes
      --rename-command FLUSHALL ""
      --rename-command FLUSHDB ""
      --rename-command CONFIG ""
    cap_drop:
      - ALL
    cap_add:
      - SETUID
      - SETGID
    networks:
      - backend
 
volumes:
  pgdata:
    driver: local
 
networks:
  backend:
    driver: bridge
    internal: true
 
secrets:
  db_password:
    file: ./secrets/db_password.txt

# GitHub Actions workflow for container security scanning
name: Container Security Scan
 
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
 
jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Build image
        run: docker build -t myapp:${{ github.sha }} .
 
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: myapp:${{ github.sha }}
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'  # Fail build on critical/high findings
 
      - name: Run Docker Scout
        uses: docker/scout-action@v1
        with:
          command: cves
          image: myapp:${{ github.sha }}
          only-severities: critical,high
          exit-code: true
 
      - name: Test container security
        run: |
          # Verify non-root user
          UID=$(docker run --rm myapp:${{ github.sha }} id -u)
          [ "$UID" != "0" ] || (echo "FAIL: Running as root" && exit 1)
          
          # Verify read-only filesystem works
          docker run --rm --read-only myapp:${{ github.sha }} echo "ok"
          
          # Verify minimal capabilities work
          docker run --rm --cap-drop ALL myapp:${{ github.sha }} echo "ok"
          
          echo "All security tests passed"

// Secure secrets loading for Node.js applications
import fs from 'fs';
import path from 'path';
 
interface SecretConfig {
  name: string;
  required: boolean;
  fallbackEnvVar?: string;
}
 
const secrets: SecretConfig[] = [
  { name: 'DB_PASSWORD', required: true },
  { name: 'API_KEY', required: true },
  { name: 'JWT_SECRET', required: true },
  { name: 'REDIS_PASSWORD', required: false, fallbackEnvVar: 'REDIS_PASSWORD' }
];
 
class SecretManager {
  private cache = new Map<string, string>();
 
  getSecret(name: string): string {
    if (this.cache.has(name)) {
      return this.cache.get(name)!;
    }
 
    const value = this.loadSecret(name);
    if (value) {
      this.cache.set(name, value);
    }
    return value;
  }
 
  private loadSecret(name: string): string {
    // Docker secrets path
    const secretPath = `/run/secrets/${name.toLowerCase()}`;
    if (fs.existsSync(secretPath)) {
      return fs.readFileSync(secretPath, 'utf-8').trim();
    }
 
    // Environment variable file path
    const fileEnvVar = `${name}_FILE`;
    const filePath = process.env[fileEnvVar];
    if (filePath && fs.existsSync(filePath)) {
      return fs.readFileSync(filePath, 'utf-8').trim();
    }
 
    // Direct environment variable
    const envValue = process.env[name];
    if (envValue) {
      return envValue;
    }
 
    return '';
  }
 
  validateRequired(): void {
    const config = secrets.find(s => s.name === 'DB_PASSWORD');
    for (const secret of secrets) {
      const value = this.getSecret(secret.name);
      if (secret.required && !value) {
        throw new Error(`Required secret ${secret.name} is not configured`);
      }
    }
  }
}
 
export const secretManager = new SecretManager();

// Measure security overhead
import { performance } from 'perf_hooks';
 
async function measureOverhead() {
  const iterations = 1000;
  
  // Baseline: no security constraints
  const baselineStart = performance.now();
  for (let i = 0; i < iterations; i++) {
    execSync('docker run --rm alpine echo test');
  }
  const baselineTime = performance.now() - baselineStart;
  
  // Hardened: security constraints applied
  const hardenedStart = performance.now();
  for (let i = 0; i < iterations; i++) {
    execSync('docker run --rm --read-only --cap-drop ALL --security-opt no-new-privileges alpine echo test');
  }
  const hardenedTime = performance.now() - hardenedStart;
  
  const overhead = ((hardenedTime - baselineTime) / baselineTime) * 100;
  console.log(`Security overhead: ${overhead.toFixed(2)}%`);
}

# Distroless Node.js image
FROM node:20-alpine AS builder
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci --omit=dev
COPY . .
 
FROM gcr.io/distroless/nodejs20-debian12
WORKDIR /app
COPY --from=builder /app .
CMD ["src/index.js"]

# Verify distroless has no shell
docker run --rm -it gcr.io/distroless/nodejs20-debian12 /bin/sh
# Error: exec: "/bin/sh": not found
 
# Debug distroless with debug tag
docker run --rm -it gcr.io/distroless/nodejs20-debian12:debug /bin/sh
# Works (debug tag includes busybox shell)

# Custom Falco rules for container security monitoring
- rule: Terminal Shell in Container
  desc: Detect shell access in production containers
  condition: >
    spawned_process and container and
    shell_procs and
    not k8s.ns.name in (kube-system, monitoring)
  output: >
    Shell spawned in container
    (user=%user.name container=%container.name
     shell=%proc.name parent=%proc.pname
     command=%proc.cmdline)
  priority: CRITICAL
 
- rule: Sensitive File Access in Container
  desc: Detect access to sensitive files
  condition: >
    open_read and container and
    (fd.name startswith /etc/shadow or
     fd.name startswith /etc/passwd or
     fd.name contains .ssh)
  output: >
    Sensitive file accessed in container
    (file=%fd.name user=%user.name container=%container.name)
  priority: WARNING
 
- rule: Unexpected Outbound Connection
  desc: Detect outbound connections to non-allowed destinations
  condition: >
    outbound and container and
    not (fd.sip in (internal_ips))
  output: >
    Unexpected outbound connection
    (command=%proc.cmdline connection=%fd.name container=%container.name)
  priority: WARNING

#!/bin/bash
# container-security-test.sh - Comprehensive security validation
 
IMAGE=$1
FAILURES=0
 
assert_pass() {
  echo "✓ $1"
}
 
assert_fail() {
  echo "✗ $1"
  FAILURES=$((FAILURES + 1))
}
 
echo "=== Container Security Tests for $IMAGE ==="
 
# Test: Non-root user
UID_CHECK=$(docker run --rm "$IMAGE" id -u 2>/dev/null)
if [ "$UID_CHECK" != "0" ]; then
  assert_pass "Running as non-root user (UID: $UID_CHECK)"
else
  assert_fail "Running as root (UID: 0)"
fi
 
# Test: Read-only filesystem
if docker run --rm --read-only "$IMAGE" echo ok >/dev/null 2>&1; then
  assert_pass "Works with read-only filesystem"
else
  assert_fail "Requires writable root filesystem"
fi
 
# Test: Minimal capabilities
if docker run --rm --cap-drop ALL "$IMAGE" echo ok >/dev/null 2>&1; then
  assert_pass "Works with all capabilities dropped"
else
  assert_fail "Requires additional capabilities"
fi
 
# Test: No-new-privileges
if docker run --rm --security-opt no-new-privileges:true "$IMAGE" echo ok >/dev/null 2>&1; then
  assert_pass "Works with no-new-privileges"
else
  assert_fail "Requires privilege escalation"
fi
 
# Test: Resource limits
if docker run --rm --memory 256m --cpus 0.5 "$IMAGE" echo ok >/dev/null 2>&1; then
  assert_pass "Works within resource limits"
else
  assert_fail "Cannot run within resource limits"
fi
 
# Test: No setuid binaries
SUID_COUNT=$(docker run --rm "$IMAGE" sh -c "find / -type f -perm -4000 2>/dev/null | wc -l" 2>/dev/null || echo "N/A")
if [ "$SUID_COUNT" = "0" ] || [ "$SUID_COUNT" = "N/A" ]; then
  assert_pass "No setuid binaries found"
else
  assert_fail "Found $SUID_COUNT setuid binaries"
fi
 
echo ""
echo "=== Results: $FAILURES failures ==="
exit $FAILURES