Skip to content

Latest commit

 

History

History
244 lines (183 loc) · 7.57 KB

Demos.md

File metadata and controls

244 lines (183 loc) · 7.57 KB
Raw

Demos

Application Configuration

  • Show Program.cs

  • Show configurations

    • Logging
    • Options configuration
    • Health probes

  • Explain how to add default docker files

    • VS Code > Open command palette > Docker: Add Docker Files to Workspace...

  • Show Dockerfile.default

    • Explain multi-stage build
    • Explain what happens

  • Build and run the default docker container image

    • Build:

      docker build -t sample-app:1.0.0 -t sample-app:latest -f src/DotnetContainerOptimization.SampleApp/Dockerfile.default src/DotnetContainerOptimization.SampleApp

      See scripts/docker/docker-build-default.sh

    • Run:

      docker run --rm -it -p 5108:5108 sample-app:1.0.0

  • Show running

  • Update configuration via environment variables

    • Run:

      docker run --rm -it -p 5108:5108 -e Greetings__To=guys sample-app:1.0.0

  • Update application host config (kestrel)

Minimize container size

Image best practices

  • Show best practice errors of dockerfile.alpine

    • Run:

      dockle sample-app-alpine:1.0.0

  • Remove findings

    • Enable docker content trust

      export DOCKER_CONTENT_TRUST=1

    • Add HEALTHCEHCK to dockerfile.alpine and explain

  • Build image again

  • Run dockle again

Non-root user

Vulnerability checks

Patch images with copacetic

  • Run trivy against default image
  • Run trivy to create vulnarability scan result and copacetic to patch the image
    • Run: 
      trivy image --vuln-type os --ignore-unfixed -f json -o report.json sample-app:1.0.0
copa patch -i sample-app:1.0.0 -r report.json

      See scripts/copacetic/copa-patch.sh

  • Run trivy against patched image
    • Run: 
      trivy image sample-app:1.0.0-patched

Sign images

  • Ensure local registry is running

  • Run and explain scripts

    1. add image to registry

      ./notation-add-image-to-local-registry.sh

    2. Generate a test key and self-signed certificate

      ./notation-create-cert-self-signed.sh

    3. Verify container image

      ./notation-sign-image.sh

    4. Create a trust policy to verify against

      notation-import-trust-policy.sh

    5. Verify the image

      ./notation-verify-image.sh

  • (Optional) Show image signing and verification with Azure Key Vault and Azure Container Registry

Build Multi-arch image

  • Create Builder

    docker buildx create --name mybuilder --platform linux/amd64,linux/arm64 --use

  • Check the new builder

    docker buildx inspect

  • Build multi-arch image from Dockerfile.default-multi-arch

    docker buildx build --platform linux/amd64,linux/arm64 -t sample-app:1.0.0 -f ./src/DotnetContainerOptimization.SampleApp/Dockerfile.default-multi-arch ./src/DotnetContainerOptimization.SampleApp

    See 'docker-build-default-multi-arch.sh'

  • Build and push to ACR

    • Ensure required Azure infra

    • Login to acr

      az acr login -n <acr name>

    • Build and push

      docker buildx build --platform linux/amd64,linux/arm64 \
-t <acr url>/sample-app:1.0.0 \
--push \
-f ./src/DotnetContainerOptimization.SampleApp/Dockerfile.default-multi-arch ./src/DotnetContainerOptimization.SampleApp

    • Check the manifest with multi-arch details in manifest