Container Registry는 지원 중단되었으며 종료될 예정입니다. 2024년 5월 15일부터 Artifact Registry는 이전 Container Registry를 사용하지 않고 프로젝트의 gcr.io 도메인 이미지를 호스팅합니다. 2025년 3월 18일 이후에는 Container Registry가 종료됩니다.
Docker는 Docker Bench for Security라는 오픈소스 스크립트를 제공합니다.
이 스크립트를 사용하면 CIS Docker Benchmark를 기준으로 실행 중인 Docker 컨테이너의 유효성을 검사할 수 있습니다.
Docker Bench For Security는 CIS Docker Benchmark의 여러 항목을 확인하는 데 도움이 되지만 모든 항목을 스크립트로 확인할 수 있는 것은 아닙니다.
예를 들어 스크립트는 컨테이너의 호스트가 강화되었는지, 컨테이너 이미지에 개인 정보가 포함되어 있는지 확인할 수 없습니다. 벤치마크의 모든 항목을 검토하고 추가 확인이 필요한 사항을 파악하세요.
배포 보호
Google Cloud에서 보안 소프트웨어 공급망을 구축하고 취약점 스캔 및 Binary Authorization을 사용하여 배포 정책을 정의하고 시행하는 방법에 대해 알아보세요.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2024-12-21(UTC)"],[[["\u003cp\u003eThis page details best practices for building and managing container images, which directly impacts build and deployment speed, as well as maintenance efforts.\u003c/p\u003e\n"],["\u003cp\u003eWhen using images from public sources, it is recommended to build your own, use a standardized base image, scan for vulnerabilities, and enforce deployment policies to enhance security.\u003c/p\u003e\n"],["\u003cp\u003eBefore making registries public, ensure images are shareable, be aware of network egress costs, and consider capping per-user quota to prevent abuse.\u003c/p\u003e\n"],["\u003cp\u003eRemoving unused container images helps reduce storage costs and mitigate risks associated with using outdated software.\u003c/p\u003e\n"],["\u003cp\u003eUtilizing tools like Docker Bench for Security can help assess and improve the security of Docker containers, though some aspects require manual verification.\u003c/p\u003e\n"]]],[],null,["# Best practices for containers\n\nThis page provides information about best practices for building and running\ncontainer images.\n\nBuilding containers\n-------------------\n\nThe approach that you take to building container images can impact the\nspeed of builds and deployments, as well as the effort required to maintain\nyour images.\n\nRead the [Docker best practices](https://docs.docker.com/develop/develop-images/dockerfile_best-practices/) for building images.\n\nConsiderations for public registries\n------------------------------------\n\nCarefully consider the following cases:\n\nUsing images from public sources\n\n: When you use images from public sources such as Docker Hub, you are\n introducing code that your organization does not control into your software\n supply chain. To mitigate risk, you can:\n\n - Build your own images to control image content.\n - Use a standardized base image and build on top of that image.\n - Scan images for vulnerabilities and address identified vulnerabilities.\n - Enforce standards and policies on images you deploy.\n\nMaking your registries public\n\n: You can make the registry in your Google Cloud project public by granting\n read access on the registry storage bucket to the `allUsers` identity.\n\n If all your users have Google Cloud accounts, you can limit access\n to authenticated users with the `allAuthenticatedUsers` identity instead.\n\n Consider the following guidelines before making a registry public:\n\n - Verify that all images you store in the registry are sharable publicly and do not expose credentials, personal data, or confidential data.\n - You are charged for [network egress](/container-registry/docs/pricing) when users pull images. If you expect a lot of internet download traffic, consider the associated costs.\n - By default, projects have unlimited per-user [quota](/container-registry/quotas). To prevent abuse, [cap](/docs/quotas/view-manage#capping_usage) per-user quotas within your project.\n\nRemoving unused images\n----------------------\n\nRemove unused container images to reduce storage costs and mitigate the risks of\nusing older software. There are a number of tools available to help with\nthis task, including [gcr-cleaner](https://github.com/sethvargo/gcr-cleaner). The gcr-cleaner tool is not an official Google product.\n| **Warning:** Do not use Cloud Storage \\[object lifecycle management\\] with Container Registry storage buckets. Lifecycle management does not work with images stored in Container Registry.\n\nAssessing container security\n----------------------------\n\nThe Center for Internet Security (CIS) has a [Docker Benchmark](https://www.cisecurity.org/benchmark/docker/) for evaluating\nthe security of a Docker container.\n\nDocker provides an open source script called [Docker Bench for Security](https://github.com/docker/docker-bench-security).\nYou can use the script to validate a running Docker container against the CIS\nDocker Benchmark.\n\nDocker Bench For Security can help you verify many items in the CIS Docker\nBenchmark, but not all items are verifiable with the script.\nFor example, the script cannot verify if the host for the container is hardened\nor if the container image includes personal data. Review all items in the\nbenchmark and identify those that might need additional verification.\n\nSecuring deployments\n--------------------\n\nLearn about building a [secure software supply chain](/software-supply-chain-security/docs/overview) and\nhow to use vulnerability scanning and Binary Authorization on Google Cloud to define\nand enforce policies for deployment.\n\nYou can also watch a video that describes securing your software supply chain."]]
