基础设施与运维
docker-compose-stack-security
更新于 2026-07-17
Docker Compose · 安全规则
Security rules for Docker Compose: boundary validation, server-side authorisation and zero secret leakage.
- 技术栈
- Docker Compose
- 主题
- 安全
- 条目
- 9 条
- 版本
- v0.2.0
✓ 应当这么做
- ✓ Validate and normalise every input at the boundary it enters the system
- ✓ Authorise on the server against the authenticated principal, never on client claims
- ✓ Keep secrets out of repositories, logs and error messages
✕ 常见反模式
- ✕ Trusting headers or parameters that a client can set freely
- ✕ Disabling TLS verification or CSRF protection to unblock a test
- ✕ Wide-scope tokens with no expiry
◎ 交付前验证
- ◎ Image scanned and no new critical CVEs introduced
- ◎ Container exits cleanly on SIGTERM within the grace period
- ◎ Final image size compared against the previous build
同分类条目
38 篇基础设施与运维
Docker 工程规则
Production Dockerfile rules: minimal multi-stage images and non-root runtime
基础设施与运维
Docker Compose 工程规则
Compose rules: explicit healthchecks, pinned images and network segmentation
基础设施与运维
Kubernetes 工程规则
Kubernetes rules: resource limits, readiness probes and rolling-update safety
基础设施与运维
Helm 工程规则
Helm rules: values schema validation and template-time guard rails
基础设施与运维
Terraform 工程规则
Terraform rules: locked remote state, reviewed plans and no console drift
基础设施与运维
Ansible 工程规则
Ansible rules: idempotent tasks, changed_when discipline and vaulted secrets