绿盟科技官方微信 0 0101 0101 10 1010 1 1010 1010 010 0101 0 0101 0101 101 1010 0 0101 0101 101 1010 101 1010 0 0101 0 0101 0101 101 1010 101 1010 101 1010 0 0101 0101 0101 010 0101 010 0101 101 1010 2018 绿盟科技 容器安全技术报告 绿盟科技星云实验室 m o c . 5 h t i g b u © 2018 绿盟科技 关于绿盟科技 北京神州绿盟信息安全科技股份有限公司（以下简称绿盟科技），成立于 2000 年 4 月，总 部位于北京。在国内外设有 40 多个分支机构，为政府、运营商、金融、能源、互联网以及教育、 医疗等行业用户，提供具有核心竞争力的安全产品及解决方案，帮助客户实现业务的安全顺畅运行。 基于多年的安全攻防研究，绿盟科技在检测防御类、安全评估类、安全平台类、远程安全运 维服务、安全 SaaS 服务等领域，为客户提供入侵检测 / 防护、抗拒绝服务攻击、远程安全评估 以及 Web 安全防护等产品以及安全运营等专业安全服务。 北京神州绿盟信息安全科技股份有限公司于 2014 年 1 月 29 日起在深圳证券交易所创业板上 市交易，股票简称：绿盟科技，股票代码：300369。 m o 关于 NeuVector b u c . 5 NeuVector 是最早开发 Docker/Kubernetes 安全产品的公司，是 Kubernetes 网络安全的领导 者，是第一也是目前唯一的多矢量容器安全平台发明者。 h t i g NeuVector 致力于保障企业级容器平台安全，产品适用于各种云环境、跨云或者本地部署等 容器生产环境。NeuVector 提供实时深入的容器网络可视化、东西向容器网络监控、主动隔离和 保护、容器主机安全以及容器内部安全。和容器管理平台无缝集成并且实现应用级容器安全的自 动化。 NeuVector 的客户涵盖了全球各个领域的大型领导企业：金融行业、医疗保险行业、出版业、 新兴的互联网企业等等。NeuVector 的技术以及商业合作伙伴包括：AWS、Docker、Google、 IBM、Rancher、Red Hat、阿里云等等。NeuVector 拥有丰富经验的创始团队，来自于各个硅谷 的 知 名 公 司， 包 括 Fortinet、VMware、Trend Micro、Symantec、Juniper 等 等。NeuVector 在 行为学习、网络安全、数据安全、容器安全等领域拥有多项美国技术专利。 010 0101 010 0101 010 0101 010 0101 101 1010 101 1010 101 1010 101 1010 01 0101 0101 101 1010 101 1010 1010 010 0101 1 1010 1010 010 0101 0 0101 2018 绿盟科技 容器安全技术报告 2018 绿盟科技容器安全技术报告 C O N T A I N E R S E C U R I T Y b u c . 5 h t i g m o 绿盟科技星云实验室 2018 年 10 月 0101 0101 0 0101 0101 绿盟科技官方微信 10 010 0101 2018 绿盟科技 容器安全技术报告 2018 绿盟科技 容器安全技术报告 0101 0101 0 0101 0101 101 1010 010 0101 1 0 1 前言 ························································································································1 10 1010 1010 0 1 0 01 0101 0101 1 1. 概述 ····················································································································2 0 1 10 1010 1010 0 1 0 0101 1.1 容器与虚拟化 ·················································································································· 3 01 0101 目录 0 0101 0101 101 1010 0 0101 0101 101 1010 101 1010 010 0101 01 0101 1 1010 1010 1010 0 1 0 01 2018 绿盟科技容器安全技术报告 0101 0101 1 0 1 10 1010 1010 1.2 容器发展历程··················································································································· 4 1.3 容器安全··························································································································· 5 2. 容器基础 ············································································································8 2.1 容器镜像··························································································································· 9 m o 2.1.1 镜像简介 ·································································································································· 9 2.1.2 镜像特点 ·································································································································· 9 c . 5 2.1.3 镜像的构建 ···························································································································· 10 2.1.4 镜像仓库 ································································································································ 11 2.1.5 镜像的使用 ···························································································································· 12 b u 2.2 容器存储·························································································································13 2.2.1 镜像元数据 ···························································································································· 13 2.2.2 存储驱动 ································································································································ 13 h t i g 2.2.3 数据卷 ···································································································································· 14 2.3 容器网络·························································································································15 2.3.1 容器网络支撑技术 ················································································································ 15 2.3.2 主机网络 ································································································································ 16 2.3.3 集群网络 ·································