目标:

满足团队需求 Docker 镜像 镜像需符合安全审计要求

镜像要求

最简化安装 需要解决 glibc ( ghost ) 漏洞 修改 ulimit 65535 限制 添加用户 apps 修改 apps, root 密码

制作方法

利用 image-withyum.sh 创建 docker 干净镜像 (参见下方附件地址) 利用 DockerFile 完成系统修改

镜像创建

利用 image-withyum.sh 脚本进行镜像创建

1. 建议在相同的环境下进行脚本创建 ( 如 centos 6.X 在 centos 6 系统上进行镜像创建 ) 2. 当前需要指定 对应的 yum.repos.d 中的源, (假如 centos7 中创建 centos6.x 镜像, 需要重新创建对应指向 centos6 的源) 3. 安装过程中需要指定安装软件包组 (可以通过 yum grouplist 查询) 及对应的软件包 (软件包建议指定版本名称) 4. 当前服务器必须启动 docker daemon, 因为创建 images 时, images 会自动导入到本地 registry cache 中 5. 查询创建后的 docker images 的命令: docker images 6. 启动对应容器方法: docker run -itd centos6:6.6 /bin/bash 7. 关闭并删除容器方法: docker stop xxxxx; docker rm xxxxxx; 8. 删除 docker images 命令: docker rmi xxxxxxx 9. 拉取对应 docker images 方法, 例: docker save -o centos6.v1.tar centos6:v1

参考命令

./image-withyum.sh -y yum.conf -g Base -p "bash-4.1.2-29.el6 sudo-1.8.6p3-15.el6 glibc-2.12-1.192.el6 vim-minimal-7.2.411-1.8.el6 yum-3.2.29-60.el6 passwd-0.77-4.el6_2.2" centos6 &> /tmp/install

脚本下载:

#!/usr/bin/env bash # # Create a base CentOS Docker image. # # This script is useful on systems with yum installed (e.g., building # a CentOS image on CentOS). See contrib/mkimage-rinse.sh for a way # to build CentOS images on other systems. usage() { cat <<EOOPTS $(basename $0) [OPTIONS] <name> OPTIONS: -p "<packages>" The list of packages to install in the container. The default is blank. -g "<groups>" The groups of packages to install in the container. The default is "Core". -y <yumconf> The path to the yum config to install packages from. The default is /etc/yum.conf for Centos/RHEL and /etc/dnf/dnf.conf for Fedora EOOPTS exit 1 } # option defaults yum_config=/etc/yum.conf if [ -f /etc/dnf/dnf.conf ] && command -v dnf &> /dev/null; then yum_config=/etc/dnf/dnf.conf alias yum=dnf fi install_groups="Core" while getopts ":y:p:g:h" opt; do case $opt in y) yum_config=$OPTARG ;; h) usage ;; p) install_packages="$OPTARG" ;; g) install_groups="$OPTARG" ;; \?) echo "Invalid option: -$OPTARG" usage ;; esac done shift $((OPTIND - 1)) name=$1 if [[ -z $name ]]; then usage fi target=$(mktemp -d --tmpdir $(basename $0).XXXXXX) set -x mkdir -m 755 "$target"/dev mknod -m 600 "$target"/dev/console c 5 1 mknod -m 600 "$target"/dev/initctl p mknod -m 666 "$target"/dev/full c 1 7 mknod -m 666 "$target"/dev/null c 1 3 mknod -m 666 "$target"/dev/ptmx c 5 2 mknod -m 666 "$target"/dev/random c 1 8 mknod -m 666 "$target"/dev/tty c 5 0 mknod -m 666 "$target"/dev/tty0 c 4 0 mknod -m 666 "$target"/dev/urandom c 1 9 mknod -m 666 "$target"/dev/zero c 1 5 # amazon linux yum will fail without vars set if [ -d /etc/yum/vars ]; then mkdir -p -m 755 "$target"/etc/yum cp -a /etc/yum/vars "$target"/etc/yum/ fi if [[ -n "$install_groups" ]]; then yum -c "$yum_config" --installroot="$target" --releasever=/ --setopt=tsflags=nodocs \ --setopt=group_package_types=mandatory -y groupinstall $install_groups fi if [[ -n "$install_packages" ]]; then yum -c "$yum_config" --installroot="$target" --releasever=/ --setopt=tsflags=nodocs \ --setopt=group_package_types=mandatory -y install $install_packages fi yum -c "$yum_config" --installroot="$target" -y clean all cat > "$target"/etc/sysconfig/network <<EOF NETWORKING=yes HOSTNAME=localhost.localdomain EOF # effectively: febootstrap-minimize --keep-zoneinfo --keep-rpmdb --keep-services "$target". # locales rm -rf "$target"/usr/{{lib,share}/locale,{lib,lib64}/gconv,bin/localedef,sbin/build-locale-archive} # docs and man pages rm -rf "$target"/usr/share/{man,doc,info,gnome/help} # cracklib rm -rf "$target"/usr/share/cracklib # i18n rm -rf "$target"/usr/share/i18n # yum cache rm -rf "$target"/var/cache/yum mkdir -p --mode=0755 "$target"/var/cache/yum # sln rm -rf "$target"/sbin/sln # ldconfig rm -rf "$target"/etc/ld.so.cache "$target"/var/cache/ldconfig mkdir -p --mode=0755 "$target"/var/cache/ldconfig version= for file in "$target"/etc/{redhat,system}-release do if [ -r "$file" ]; then version="$(sed 's/^[^0-9\]*\([0-9.]\+\).*$/\1/' "$file")" break fi done if [ -z "$version" ]; then echo >&2 "warning: cannot autodetect OS version, using '$name' as tag" version=$name fi tar --numeric-owner -c -C "$target" . | docker import - $name:$version docker run -i -t --rm $name:$version /bin/bash -c 'echo success' rm -rf "$target"

基础镜像系统修改

创建 DockerFile 利用 DockerFile 对上面创建的镜像进行修改

参考命令:

docker build --tag="centos6:v1" --file="DockerFile" .

参考 DockerFile

# Dockerfile that modifies centos6:6.6 # add apps user, sed apps user passwd (XXXXXXX) , modify root password (XXXXXX) # FROM centos6:7.2.1511 MAINTAINER terry.zeng <signmem@hotmail.com> RUN useradd apps ; echo 'XXXXXXX' | passwd --stdin root ; echo 'XXXXXXXXXX' | passwd --stdin apps ; rm -rf /etc/security/limits.d/*nproc.conf ; echo 'apps ALL=(root) NOPASSWD: ALL' >> /etc/sudoers