Security & supply chain

Dockerfile# Create an unprivileged user at build time and run as its NUMERIC id.
# A numeric USER lets the orchestrator enforce runAsNonRoot (it can't resolve names).
FROM python:3.12-slim
RUN useradd --uid 10001 --create-home --shell /usr/sbin/nologin appuser
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY --chown=10001:10001 . .
USER 10001
CMD ["python", "app.py"]

run-hardened.sh# Read-only root FS: app can't write anywhere except the tmpfs you allow.
# --cap-drop=ALL removes every Linux capability; add back only what you truly need.
docker run --rm \
  --read-only \
  --tmpfs /tmp:rw,noexec,nosuid,size=64m \
  --cap-drop=ALL \
  --security-opt no-new-privileges \
  --user 10001 \
  myapp:1.4.2

# If the app truly needs to bind port 80 as non-root, add the ONE cap:
#   --cap-drop=ALL --cap-add=NET_BIND_SERVICE
# Verify flag names/behavior against current Docker docs — they evolve.

runtime_risk.pydef runtime_risk(cfg):
    """Higher score = more blast radius if the container is compromised."""
    score = 0
    if cfg["user"] == "root":         score += 50
    if cfg["writable_rootfs"]:        score += 20
    score += 5 * len(cfg["caps"])          # each retained capability adds risk
    if cfg["new_privileges"]:         score += 15   # setuid escalation possible
    return score

default = dict(user="root", writable_rootfs=True,
               caps=["CHOWN","SETUID","SETGID","NET_RAW","MKNOD","..."], new_privileges=True)
hardened = dict(user="10001", writable_rootfs=False,
                caps=[], new_privileges=False)
print("default runtime risk :", runtime_risk(default))
print("hardened runtime risk:", runtime_risk(hardened))

Dockerfile.distroless# Build with a full toolchain, then ship into distroless (no shell, no pkg mgr).
FROM python:3.12 AS build
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir --target=/deps -r requirements.txt

# gcr.io/distroless/python3-debian12 ships CPython + libs, nothing else.
# Verify the exact tag/name against current distroless docs (they update per-Debian).
FROM gcr.io/distroless/python3-debian12
WORKDIR /app
COPY --from=build /deps /app/deps
COPY . .
ENV PYTHONPATH=/app/deps
USER 65532                    # 'nonroot' user baked into distroless images
ENTRYPOINT ["python", "app.py"]

scan.sh# Scan a built image for OS + language CVEs. Fail CI on High/Critical only.
trivy image --severity HIGH,CRITICAL --exit-code 1 myapp:1.4.2
# Grype does the same job (different DB); many teams run both:
grype myapp:1.4.2 --fail-on high

# Generate an SBOM in the standard SPDX or CycloneDX format:
syft myapp:1.4.2 -o spdx-json > sbom.spdx.json
# Then scan the SBOM itself (fast, no re-pull) and attach it to the image later:
grype sbom:sbom.spdx.json --fail-on critical

# Flag names (--exit-code, --fail-on, -o) drift between versions — verify current docs.

scan_gate.pydef scan_gate(findings, allowlist=()):
    """findings: [{"id","severity","pkg","fixed_in"}]. Block on unfixed High/Critical
    that are not explicitly, temporarily allowlisted (with an expiry, in real life)."""
    blocking = []
    for f in findings:
        if f["severity"] in ("HIGH", "CRITICAL") and f["id"] not in allowlist:
            reason = "no fix yet" if not f["fixed_in"] else f"fix: {f['fixed_in']}"
            blocking.append((f["id"], f["severity"], f["pkg"], reason))
    return ("FAIL" if blocking else "PASS"), blocking

findings = [
    {"id": "CVE-2024-1111", "severity": "CRITICAL", "pkg": "libxyz", "fixed_in": "1.2.4"},
    {"id": "CVE-2024-2222", "severity": "LOW",      "pkg": "zlib",   "fixed_in": ""},
    {"id": "CVE-2023-9999", "severity": "HIGH",     "pkg": "openssl","fixed_in": "3.0.14"},
]
verdict, blocking = scan_gate(findings, allowlist={"CVE-2023-9999"})  # risk-accepted, tracked
print(verdict)
for b in blocking: print("  BLOCK", *b)

cosign.sh# Keyless signing: cosign gets a short-lived cert from Fulcio bound to the CI's
# OIDC identity, logs the signature to the Rekor transparency log. No key to leak.
cosign sign myrepo/myapp@sha256:<digest>      # sign the DIGEST, never a mutable tag

# On deploy, verify BOTH the identity that signed it and where the token came from:
cosign verify myrepo/myapp@sha256:<digest> \
  --certificate-identity-regexp 'https://github.com/acme/.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com'

# Attach the SBOM from section 4 as an attestation, then verify it too:
cosign attest --predicate sbom.spdx.json --type spdxjson myrepo/myapp@sha256:<digest>

# Command surface changes across cosign releases — verify against current sigstore docs.

admission.py# Models what an admission controller / deploy gate does: trust nothing unverified.
TRUSTED_ISSUER = "https://token.actions.githubusercontent.com"
TRUSTED_IDENTITY = "https://github.com/acme/"

def admit(image):
    if "@sha256:" not in image["ref"]:
        return False, "deploying a mutable tag, not a digest"
    if not image["signed"]:
        return False, "no signature found"
    if image["oidc_issuer"] != TRUSTED_ISSUER:
        return False, f"untrusted issuer {image['oidc_issuer']}"
    if not image["signer_identity"].startswith(TRUSTED_IDENTITY):
        return False, f"untrusted signer {image['signer_identity']}"
    return True, "admitted"

good = dict(ref="myapp@sha256:abcd", signed=True, oidc_issuer=TRUSTED_ISSUER,
            signer_identity="https://github.com/acme/build")
tag  = dict(ref="myapp:latest", signed=True, oidc_issuer=TRUSTED_ISSUER,
            signer_identity="https://github.com/acme/build")
evil = dict(ref="myapp@sha256:beef", signed=True, oidc_issuer=TRUSTED_ISSUER,
            signer_identity="https://github.com/attacker/x")
for img in (good, tag, evil):
    print(admit(img))

Dockerfile.secret# syntax=docker/dockerfile:1
# The secret is mounted only for THIS run and never lands in a layer or history.
FROM python:3.12-slim
RUN --mount=type=secret,id=pip_token \
    PIP_TOKEN="$(cat /run/secrets/pip_token)" \
    pip install --no-cache-dir -r requirements.txt
# Build with:
#   DOCKER_BUILDKIT=1 docker build --secret id=pip_token,src=./pip_token.txt -t myapp .
# Do NOT use ARG for secrets: ARG values are visible in `docker history`.

secret_lint.pyimport re
SECRET_RX = re.compile(r"(AKIA[0-9A-Z]{16}|-----BEGIN|password\s*=|token\s*=)", re.I)

def scan_layers(dockerfile_lines, env):
    problems = []
    for i, line in enumerate(dockerfile_lines, 1):
        s = line.strip()
        if s.startswith("COPY") and ".env" in s:
            problems.append((i, "COPY of .env bakes secrets into a layer"))
        if s.startswith(("ENV", "ARG")) and SECRET_RX.search(s):
            problems.append((i, "secret literal in ENV/ARG (visible in history)"))
    for k, v in env.items():
        if SECRET_RX.search(f"{k}={v}"):
            problems.append((0, f"secret-shaped runtime env: {k}"))
    return problems

df = ["FROM python:3.12-slim", "COPY .env /app/.env",
      "ENV API_TOKEN=token=sk-live-abc123", 'CMD ["python","app.py"]']
for p_ in scan_layers(df, {"DB_PASSWORD": "password=hunter2"}):
    print("LEAK", p_)