Supply Chain Security (20%)

SBOM

• Supply chain security is the practice of ensuring that the software and hardware that you use in your environment is secure
• In the context of the CKS exam, supply chain security refers to the security of the software that you use in your Kubernetes environment

Reduce docker image size

• Smaller images are faster to download and deploy

• Smaller images are more secure

• Smaller images are easier to manage

• To reduce the size of a docker image:

  • Use a smaller base image
  • Use specific package/image versions
  • Make file-system read-only
  • Don’t run the container as root
  • Use multi-stage builds
  • Remove unnecessary files
  • Use a .dockerignore file to exclude files and directories from the image
  • Use COPY instead of ADD
  • Use alpine images
  • Use scratch images
  • Use distroless images

• Example of a multi-stage build:

  # build container stage 1
    FROM ubuntu
    ARG DEBIAN_FRONTEND=noninteractive
    RUN apt-get update && apt-get install -y golang-go
    COPY app.go .
    RUN CGO_ENABLED=0 go build app.go
  
  # app container stage 2
    FROM alpine:3.12.1 # it is better to use a defined tag, rather than 'latest'
    RUN addgroup -S appgroup && adduser -S appuser -G appgroup -h /home/appuser
    COPY --from=0 /app /home/appuser/app
    USER appuser # run as a non-root user
    CMD ["/home/appuser/app"]
  

• Dockerfile best practices: https://docs.docker.com/build/building/best-practices/

• Only certain docker directives create new layers in an image

  • FROM
  • COPY
  • CMD
  • RUN

• dive and docker-slim are two tools you can use to explore the individual layers that make up an image

Static Analysis

SBOM

• A SBOM is a list of all the software that makes up a container image (or an application, etc.)
• Formats
  • SPDX
    • The standard format for sharing SBOM
    • Available in JSON, RDF, and tag/value formats
    • More complex than CycloneDX due to it’s extensive metadata coverage
    • Comprehensive metadata including license information, origin, and file details
  • CycloneDX
    • A lightweight format focused on security and compliance
    • Available in JSON and XML formats
    • Simpler and more focused on essential SBOM elements
    • Focuses on component details, vulnerabilities, and dependencies

Kubesec

• Used for static analysis of manifests
• https://github.com/controlplaneio/kubesec

Syft

• Syft is a powerful and easy-to-use open-source tool for generating Software Bill of Materials (SBOMs) for container images and filesystems. It provides detailed visibility into the packages and dependencies in your software, helping you manage vulnerabilities, license compliance, and software supply chain security.
• Syft can export results in SPDX, CycloneDX, JSON, etc.
• To scan an image with syft and export the results to a file in SPDX format:

  syft scan docker.io/kodekloud/webapp-color:latest -o spdx --file /root/webapp-spdx.sbom
  

Grype

• Grype is a tool (also from Anchore) that can be used to scan SBOM for vulnerabilities
• To scan a SBOM with Grype:

  grype /root/webapp-sbom.json -o json --file /root/grype-report.json
  

Kube-linter

• Kube-linter can be used to lint Kubernetes manifests and ensure best practices are being followed
• kube-linter is configurable. You can disable/enable checks and even create your own custom checks
• kube-linter includes recommendations for how to fix failed checks
• https://github.com/stackrox/kube-linter

Scanning Images for Vulnerabilities

trivy

• trivy can be used to scan images, git repos, and filesystems for vulnerabilities
• https://github.com/aquasecurity/trivy
• Example:

    sudo docker run --rm  aquasec/trivy:0.17.2 nginx:1.16-alpine