https://souljian.cn/tags/k8s/Recent content in K8s on SoulJian小站Hugo -- gohugo.ioen-usSun, 30 Aug 2026 10:00:00 +0800https://souljian.cn/p/751088204/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088204/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>容器安全测试只在授权环境进行。</p> <h2 id="一dockerk8s-安全">一、Docker/K8s 安全 </h2><img src="https://souljian.cn/img/k8s-security.svg" alt="Docker 与 Kubernetes 安全" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">容器逃逸 · 镜像安全 · K8s API 滥用 · 配置错误 · CIS 加固 </span></span></code></pre></td></tr></table> </div> </div><h2 id="二docker-逃逸方式">二、Docker 逃逸方式 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">Docker Socket 挂载 · 特权容器 · 宿主机目录挂载 </span></span><span class="line"><span class="cl">内核漏洞 · K8s API 未授权 </span></span></code></pre></td></tr></table> </div> </div><h2 id="三防御加固">三、防御加固 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">镜像安全：Trivy/Grype 扫描 CVE </span></span><span class="line"><span class="cl">容器配置：禁止 --privileged · 非 root 用户 </span></span><span class="line"><span class="cl">K8s 安全：RBAC 最小权限 · 网络策略 </span></span></code></pre></td></tr></table> </div> </div><h2 id="四小结">四、小结 </h2><p>容器安全的核心是<strong>最小权限 + 镜像安全 + K8s RBAC</strong>。</p>