Harden your Docker Containers using a Bitbucket pipeline

Prerequisites

1. RapidFort Server (SaaS or On-Premises)
2. RapidFort Service Account
3. Self-hosted Linux Bitbucket Runner with RapidFort CLI tools installed on it.
4. Deployment Environment (for example, Kubernetes, Docker, Docker-Compose, AWS Fargate) must:
   1. have HTTPS access to the RapidFort server
   2. provide support for adding the SYS_PTRACE Linux kernel capability
5. Container Registry (for example, Amazon Elastic Container Registry, Docker Hub, Microsoft Azure Container Registry, and so forth)

 

 

Instrument (Stub), Test, and Harden a Docker Image

1. Download the sample .bitbucket-pipelines.yml file.
2. Update the following variables in the yml file:

• RF_ROOT_URL:
  • For SaaS users, specify https://frontrow.rapidfort.com.
  • For On-Premises users, specify the hostname or IP address of your RapidFort on-premises server (for example, https://rapidfort.example.com).
• RF_ACCESS_ID: Specify the access id for your RapidFort service account.
• RF_SECRET_ACCESS_KEY: Specify the secret access key for your RapidFort service account.
• RF_CLI_UPDATE: Specify "no" to download and install the RapidFort CLI tools only if they are not already installed on the runner or "yes" to always download and install the tools (even if they are already installed).

.bitbucket-pipelines.yml

image: python:latest

 

pipelines:

  default:

    - step:

        runs-on:

          - self.hosted

          - linux

        name: 'Stub'

        services:

          - docker

        script:

          - >-

              if [ -z "$(command -v rflogin)" ] || [ "$RF_CLI_UPDATE" == "yes" ]; then

                 curl -ks "$RF_ROOT_URL"/cli/ | bash

              fi

          - echo $DOCKERHUB_TOKEN | docker login -u $DOCKERHUB_USERNAME --password-stdin

          - docker pull $DOCKER_IMAGE_NAME:$TAG

          - docker tag $DOCKER_IMAGE_NAME:$TAG $DOCKERHUB_USERNAME/$DOCKER_IMAGE_NAME:$TAG-$BITBUCKET_BUILD_NUMBER

          - rfstub $DOCKERHUB_USERNAME/$DOCKER_IMAGE_NAME:$TAG-$BITBUCKET_BUILD_NUMBER

          - docker push $DOCKERHUB_USERNAME/$DOCKER_IMAGE_NAME:$TAG-$BITBUCKET_BUILD_NUMBER-rfstub

 

    - step:

        trigger: manual

        runs-on:

          - self.hosted

          - linux

        name: 'Harden'

        services:

          - docker

        script:

          - >-

              if [ -z "$(command -v rflogin)" ] || [ "$RF_CLI_UPDATE" == "yes" ]; then

                 curl -ks "$RF_ROOT_URL"/cli/ | bash

              fi

          - echo $DOCKERHUB_TOKEN | docker login -u $DOCKERHUB_USERNAME --password-stdin

          - docker pull $DOCKERHUB_USERNAME/$DOCKER_IMAGE_NAME:$TAG-$BITBUCKET_BUILD_NUMBER-rfstub

          - rfharden $DOCKERHUB_USERNAME/$DOCKER_IMAGE_NAME:$TAG-$BITBUCKET_BUILD_NUMBER-rfstub

          - docker push $DOCKERHUB_USERNAME/$DOCKER_IMAGE_NAME:$TAG-$BITBUCKET_BUILD_NUMBER-rfhardened

 

 

Stub

During the build process, run rfstub to generate a stub image and push the stub image to your container registry.

In the sample Bitbucket pipeline template, the Stub step consists of the following actions:

• Pull the original image from the container registry
• Run rfstub to generate the stub image
• Push the stub image to the container registry

Deploy and Test

Next, deploy and test the stub image so that RapidFort can trace the runtime behavior of the application and build the runtime profile.

You must deploy and test stub images outside of Bitbucket. Currently, Bitbucket does not support adding the SYS_PTRACE Linux kernel capability, even for self-hosted runners.

 

 

Update the Deployment Configuration and Environment

• Deploy the stub image (instead of the original image)
• Add the SYS_PTRACE Linux kernel capability
• For Kubernetes environments, allow privilege escalation and enable read/write access for the root filesystem
  • allowPrivilegeEscalation: true
  • readOnlyRootFilesystem: false

Make sure that your deployment environment allows HTTPS access to the RapidFort server.

Deploy your stub image and test your application to exercise its functionalities.

Harden

After you have deployed and tested the stub image and verified that the runtime profile information was propagated to RapidFort, you are ready to harden it.

In the sample Bitbucket pipeline template, the Harden step consists of the following actions:

• Pull the stub image from the container registry
• Run rfharden to generate the hardened and optimized image
• Push the hardened image to your container registry