Secure Containers Exercise

In this Exercise we are going to

  1. Run Application locally
  2. Run in Docker compose
  3. Go Reporter for static Analysis
  4. Go Sec for code cve scanning
  5. Secure Dockerfile

You may need to start docker

sudo service docker start

Redirecting to /bin/systemctl start docker.service

Navigate to DevSecops repo cd ~/environment/devsecopspipeline

Set a temp password for the local database

export DB_PASSWORD=temppassword

1. Run locally

Run the Golang tests locally

make test

Now we can run the application locally make run

Expand me...

Test

In a new terminal test the application cd ~/environment/devsecopspipeline.

The make run just runs the golang app and not the database

make test_local

~/environment/devsecopspipeline (master) $ curl localhost:8080/
{"message":"Default Page"}
~/environment/devsecopspipeline (master) $ curl localhost:8080/data
{"message":"DB is not connected"}

2. Running in Docker Compose

Update Makefile NAME with your name or some unique identifier.

Stop the local make run and run the app with compose

make compose_up

Expand me...

Once it is up we can test the applications running in compose, same thing, new terminal and test

make test_local

~/environment/devsecopspipeline (master) $ curl localhost:8080/
{"message":"Default Page"}
~/environment/devsecopspipeline (master) $ curl localhost:8080/ping
{"message":"Pong Version `0.1.20`"}
~/environment/devsecopspipeline (master) $ curl localhost:8080/data
{"message":"Database Connected"}

3. Go Reporter

A Golang tool that does static analysis, unit testing, code review and generate code quality report.

https://github.com/qax-os/goreporter

make go_report

Expand me...

4. Go Sec

Inspects source code for security problems by scanning the Go AST.

https://securego.io/docs/rules/rule-intro.html

make go_sec

Expand me...

5. Secure Dockerfile

Let’s create a user for the application and rebuild our image

Add these lines to the dockerfile to create a new user

# Create appuser.
ENV USER=appuser
ENV UID=10001
# See https://stackoverflow.com/a/55757473/12429735RUN
RUN adduser \    
--disabled-password \    
--gecos "" \    
--home "/nonexistent" \    
--shell "/sbin/nologin" \    
--no-create-home \    
--uid "${UID}" \    
"${USER}"

Inside the app container add these lines.

# Import the user and group files from the builder.
COPY --from=builder /etc/passwd /etc/passwd
COPY --from=builder /etc/group /etc/group

# Use an unprivileged user.
USER appuser:appuser

The Dockerfile should look like this now

FROM golang:1.13-alpine AS builder

RUN apk update && apk add --no-cache git
# Create appuser.
ENV USER=appuser
ENV UID=10001
# See https://stackoverflow.com/a/55757473/12429735RUN
RUN adduser \
  --disabled-password \
  --gecos "" \
  --home "/nonexistent" \
  --shell "/sbin/nologin" \
  --no-create-home \
  --uid "${UID}" \
  "${USER}"

WORKDIR /go/src/app
COPY . .

RUN GIT_TERMINAL_PROMPT=1 go get -d -v
RUN CGO_ENABLED=0 go build -o /go/bin/app

FROM golang:1.13-alpine

COPY --from=builder /go/bin/app /go/bin/app
# Import the user and group files from the builder.
COPY --from=builder /etc/passwd /etc/passwd
COPY --from=builder /etc/group /etc/group

# Use an unprivileged user.
USER appuser:appuser

EXPOSE 8080
EXPOSE 8090

CMD ["/go/bin/app"]

This was all done locally now let’s get a pipeline running all this!