"Master production-grade best practices to build your Node.js Docker images", Liran Tal

Master production-grade best practices
to build your Node.js Docker images
Liran Tal
Snyk

@liran_tal
“87% of developers
go to sleep upset
because of terrible
Node.js Docker images”
- Anonymous

@liran_tal
FROM node
WORKDIR /usr/src/app
COPY . /usr/src/app
RUN npm install
CMD "npm" "start"
“it works”

@liran_tal
FROM node
COPY . /usr/src/app
RUN npm install
CMD "npm" "start"
$ docker build . -t nodejs-tutorial
$ docker run -p 3000:3000 nodejs-tutorial
RUN npm install

@liran_tal
FROM node
COPY . /usr/src/app
RUN npm install
CMD "npm" "start"
No reproducible builds
▶

@liran_tal
FROM node
COPY . /usr/src/app
RUN npm install
CMD "npm" "start"
Large software footprint
▶

@liran_tal
FROM node
COPY . /usr/src/app
RUN npm install
CMD "npm" "start"
Sensitive Data Exposure
▶

@liran_tal
FROM node
COPY . /usr/src/app
RUN npm install
CMD "npm" "start"
Unneeded dependencies
▶

@liran_tal
FROM node
COPY . /usr/src/app
RUN npm install
CMD "npm" "start"
No graceful shutdown
▶

Liran Tal
@liran_tal
Developer Advocate @Snyk
Node.js Ecosystem Security
working group
OWASP Project Lead
GitHub Star

@liran_tal
Docker Images Best Practices

@liran_tal
https://snyk.io/blog

@liran_tal
Docker Images Best Practices
Vulnerabilities at the heart of
developer tooling

@liran_tal
Attacking the heart of
developer tooling
// April 15, 2021
Codecov is a code quality tool
Disclosing a compromised artifact used in CI

@liran_tal
developer tooling
// April 15, 2021
“Security response professionals are scrambling to measure the fallout from a
software supply chain compromise of Codecov Bash Uploader that went
undetected since January and exposed sensitive secrets like tokens, keys and
credentials from organizations around the world.”
// SecurityWeek.com

@liran_tal
developer tooling
How did Codecov learn of Bash Uploader incident?
shasum,
4 months later,
by a community member
// April 15, 2021

@liran_tal
developer tooling
// April 15, 2021
source: https://www.bleepingcomputer.com/news/security/codecov-hackers-gained-access-to-mondaycom-source-code

@liran_tal
Use explicit and deterministic Docker
base image tags

@liran_tal
FROM node
COPY . /usr/src/app
RUN npm install
CMD "npm" "start"
▶

@liran_tal
FROM node:latest
COPY . /usr/src/app
RUN npm install
CMD "npm" "start"
What image are you pulling?
▶

@liran_tal
FROM node:latest
COPY . /usr/src/app
RUN npm install
CMD "npm" "start"
No reproducible builds
There’s a reason we use lockﬁles,
Treat your container images the same
▶

@liran_tal
FROM node:latest
COPY . /usr/src/app
RUN npm install
CMD "npm" "start"
Large software footprint
More software == more software risk
▶

@liran_tal
FROM node@sha256:b2da3316ac
COPY . /usr/src/app
RUN npm install
CMD "npm" "start"
✔ Reproducible builds
☹ Unmaintainable hash
▶

@liran_tal
FROM node:lts-alpine@sha256:b2da3316ac
COPY . /usr/src/app
RUN npm install
CMD "npm" "start"
✔ Reproducible builds
✔ Maintainable hash
▶

@liran_tal
Optimize Node.js tooling for production

@liran_tal
FROM node
COPY . /usr/src/app
RUN NODE_ENV=production npm install
CMD "npm" "start"
▶

@liran_tal
ENV NODE_ENV production
COPY . /usr/src/app
RUN npm ci --only=production
CMD "npm" "start"
✔ Frameworks and Libraries
are optimized

@liran_tal
Don’t run containers as root

@liran_tal
COPY . /usr/src/app
CMD "npm" "start"
Which user owns this process?
▶

@liran_tal
const child_process = require('child_process');
child_process.exec(cmd);
What if cmd is user controlled?

@liran_tal
const PDFImageLib = require("pdf-image").PDFImage;
const pdfData = new PDFImageLib(pdfFilePath);
npm install pdf-image

@liran_tal
const pdfData = new PDFImageLib(pdfFilePath);
What if pdfFilePath is user controlled?

@liran_tal
const pdfData = new PDFImageLib("asd.pdf"; touch /tmp/hacked"");
Like this ☝

@liran_tal
const pdfData = new PDFImageLib("asd.pdf"; touch /tmp/hacked"");

@liran_tal
COPY . /usr/src/app
USER node
CMD "npm" "start"
Drop privileges before executing
▶

@liran_tal
COPY . /usr/src/app
USER node
CMD "npm" "start"
Drop privileges before executing
But what about the ﬁles we copied?
▶

@liran_tal
COPY --chown=node:node . /usr/src/app
USER node
CMD "npm" "start"
✔ Drop privileges before executing
✔ Preserve proper permissions

@liran_tal
Terminate Node.js apps gracefully

@liran_tal
COPY . /usr/src/app
CMD "npm" "start"
▶

@liran_tal
COPY . /usr/src/app
CMD "npm" "start"
CMD ["yarn", "start"]
▶

@liran_tal
COPY . /usr/src/app
CMD "npm" "start"
CMD “node” “server.js”
▶

@liran_tal
COPY . /usr/src/app
CMD "npm" "start"
CMD “node” “server.js”
CMD “start-app.sh”
▶

@liran_tal
container
orchestration
engines
SIGKILL

@liran_tal
COPY . /usr/src/app
CMD "npm" "start"
▶
Who says npm forwards SIG* to your
Node.js process?

@liran_tal
process.on('SIGHUP', function handle(signal) {
console.log(`*^!@4=> Received event: ${signal}`)
});
1
$ docker kill --signal=SIGHUP quizzical_mendel
2
$ docker run
3

@liran_tal
COPY . /usr/src/app
CMD "npm" "start"
CMD "node" "start"
▶
Do you know what this shellform
notation actually means?

@liran_tal
root@bd200413173f:/usr/src/app# ps -aux
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.0 4280 764 ? Ss 07:42 0:00 /bin/sh -c "node" "server.js"
root 8 0.4 1.9 599108 39280 ? Sl 07:43 0:00 node server.js
root 15 0.8 0.1 18188 3228 pts/0 Ss 07:44 0:00 /bin/bash
root 24 0.0 0.1 36636 2800 pts/0 R+ 07:44 0:00 ps -aux
▶
PID who dis?

@liran_tal
COPY . /usr/src/app
CMD "npm" "start"
CMD "node" "start"
CMD ["node", "start"]
▶
Let’s try with execform

@liran_tal
“Node.js was not designed to run as PID 1 which leads to
unexpected behaviour when running inside of Docker.
For example, a Node.js process running as PID 1 will not
respond to SIGINT (CTRL-C) and similar signals”
- Node.js Docker working group
recommendations, [source].

@liran_tal
RUN apk add dumb-init
COPY . /usr/src/app
CMD ["dumb-init", "node", "server.js"]
▶
Lightweight init system: dumb-init
▶

@liran_tal
Gracefully terminate applications means
you need to clean up resources, and other chores

@liran_tal
async function closeGracefully(signal) {
console.log(`*^!@4=> Terminating: ${signal}`)
await fastify.close()
// await db.close() if we have a db connection
process.exit()
}
process.on('SIGINT', closeGracefully)
process.on('SIGTERM', closeGracefully)
▶

@liran_tal
Y U No Fix Your
Vulnerable Node.js Docker Images ?

@liran_tal
$ docker scan node:14.10.1
✗ High severity vulnerability found in imagemagick/libmagickcore-6.q16-3
Description: XML Injection
Info: https://snyk.io/vuln/SNYK-DEBIAN9-IMAGEMAGICK-1049975
Introduced through: imagemagick@8:6.9.7.4+dfsg-11+deb9u10
From: imagemagick@8:6.9.7.4+dfsg-11+deb9u10 and 24 more…
Image layer: Introduced by your base image (node:14.10.1)
Fixed in: 8:6.9.7.4+dfsg-11+deb9u11
▶

@liran_tal
Tested 412 dependencies for known issues, found 624 issues.
▶

@liran_tal
What’s the worst that can happen?
🙃

@liran_tal
▶
What now? 😕󰤇

@liran_tal
$ docker scan node:14.10.1 --file=Dockerfile
▶

@liran_tal
$ docker scan node:14.10.1 --file=Dockerfile
Base Image Vulnerabilities Severity
node:14.10.1 624 93 high, 77 medium, 454 low
Recommendations for base image upgrade:
node:14.16 561 63 high, 57 medium, 441 low
node:14.16-buster-slim 58 10 high, 5 medium, 43 low
node:14.16.0-slim 75 18 high, 8 medium, 49 low
node:15-stretch-slim 75 18 high, 8 medium, 49 low
node:15.10-buster 325 38 high, 46 medium, 241 low
▶

@liran_tal
Level up your Node.js container-fu
Follow best practices for building containers securely
source: https://snyk.io/blog/10-best-practices-to-containerize-nodejs-web-applications-with-docker/

@liran_tal
Own your Node.js containers security
Scan and monitor your Code repository & Docker images

@liran_tal
May the container gods
keep you safe 🙏
Liran Tal
liran_tal

"Master production-grade best practices to build your Node.js Docker images", Liran Tal

Recommandé

Recommandé

Contenu connexe

Similaire à "Master production-grade best practices to build your Node.js Docker images", Liran Tal

Similaire à "Master production-grade best practices to build your Node.js Docker images", Liran Tal (20)

Plus de Fwdays

Plus de Fwdays (20)

Dernier

Dernier (20)

"Master production-grade best practices to build your Node.js Docker images", Liran Tal