Belajar Security Tester - Testing Docker/K8s Deployments

#Pendahuluan

Setelah di episode 13 kita menguji cloud & infrastructure, pada episode ini kita fokus pada container dan orchestrator — Docker dan Kubernetes. Container yang tidak aman bisa membocorkan aplikasi ke seluruh cluster.

#Docker Image Scanning

#Trivy

bash

# Scan image untuk vulnerabilities
trivy image nginx:latest
 
# Scan dengan severity filter
trivy image --severity HIGH,CRITICAL nginx:latest
 
# Scan Dockerfile
trivy config --security-checks misconfig Dockerfile

#Hadolint (Dockerfile Lint)

bash

# Lint Dockerfile
hadolint Dockerfile
 
# Lint dengan format JSON
hadolint Dockerfile -f json

#Docker Security Best Practices

dockerfile

# Buruk: running as root
FROM node:22
WORKDIR /app
COPY . .
CMD ["node", "server.js"]
 
# Baik: non-root user
FROM node:22
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
WORKDIR /app
COPY --chown=appuser:appgroup . .
USER appuser
CMD ["node", "server.js"]

bash

# Cek container running as root
docker inspect <container_id> | grep -i "user"
 
# Cek capabilities
docker inspect <container_id> | grep -i "cap"

#Kubernetes Security

#Security Context

yaml

apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 2000
  containers:
    - name: app
      image: myapp:latest
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop:
            - ALL

#RBAC Testing

bash

# Cek ClusterRoleBinding
kubectl get clusterrolebindings -o yaml
 
# Test akses dengan service account
kubectl auth can-i list pods --as=system:serviceaccount:default:sa-name
kubectl auth can-i create deployments --as=system:serviceaccount:default:sa-name

#Network Policy

yaml

# Pastikan network policy mengisolasi pods
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress

Tip

Gunakan kubectl auth can-i untuk testing RBAC. Ini memungkinkan kalian mengecek permission tanpa perlu login sebagai user lain.

#Praktik: Container Security Scan

bash

# 1. Scan image dengan Trivy
trivy image --severity HIGH,CRITICAL myapp:latest
 
# 2. Lint Dockerfile
hadolint Dockerfile
 
# 3. Scan Kubernetes manifests
kube-score score deployment.yaml
 
# 4. Test RBAC
kubectl auth can-i list secrets --as=system:serviceaccount:default:default
 
# 5. Cek security context
kubectl get pod -o yaml | grep -A 10 securityContext

#Penutup

Image scanning: Trivy untuk vulnerability, Hadolint untuk Dockerfile linting.
Docker: jangan run as root, drop capabilities, read-only filesystem.
Kubernetes: security context, RBAC testing, network policies.
Defense in depth: kombinasikan image scan + runtime protection + RBAC.

Di episode 15 selanjutnya kita akan membahas data & privacy testing — data exposure, PII handling, encryption, dan compliance requirements. Sampai jumpa di episode 15!