# イメージスキャン
trivy image myapp:latest
 
# 重大度フィルタ (CRITICAL と HIGH のみ)
trivy image --severity CRITICAL,HIGH myapp:latest
 
# JSON 出力 (CI 用)
trivy image --format json --output results.json myapp:latest
 
# テーブル形式でファイルに出力
trivy image --format table --output results.txt myapp:latest
 
# Dockerfile スキャン (設定ミス検出)
trivy config Dockerfile
 
# Kubernetes マニフェストのスキャン
trivy config --policy-bundle-repository ghcr.io/aquasecurity/trivy-policies k8s/
 
# ファイルシステムスキャン (ローカルプロジェクト)
trivy fs --scanners vuln,secret .
 
# ライセンスコンプライアンスチェック
trivy image --scanners license myapp:latest
 
# SBOM 生成
trivy image --format spdx-json --output sbom.json myapp:latest
 
# 特定の CVE を無視
trivy image --ignorefile .trivyignore myapp:latest
 
# 修正版がリリースされていない脆弱性を除外
trivy image --ignore-unfixed myapp:latest

# .trivyignore
# 修正版未リリースのため一時的に無視 (2025-06-01 まで追跡)
CVE-2024-12345
 
# アプリで使用していないパッケージの脆弱性
CVE-2024-67890  # libxml2 - このアプリでは XML パースを行わない
 
# テスト環境のみで使用するパッケージ
CVE-2024-11111  # dev dependency のみ

# .github/workflows/security.yml
name: Security Scan
 
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # 毎日深夜に定期スキャン (新しい CVE の検出)
    - cron: '0 0 * * *'
 
jobs:
  hadolint:
    name: Dockerfile Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Run hadolint
        uses: hadolint/hadolint-action@v3
        with:
          dockerfile: Dockerfile
          failure-threshold: warning
 
  trivy-scan:
    name: Image Vulnerability Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Build image
        run: docker build -t myapp:${{ github.sha }} .
 
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: myapp:${{ github.sha }}
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'           # 脆弱性が見つかったら失敗
          ignore-unfixed: true
 
      - name: Upload Trivy scan results
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: 'trivy-results.sarif'
 
  trivy-config:
    name: Configuration Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Scan Dockerfile for misconfigurations
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'config'
          scan-ref: '.'
          exit-code: '1'
          severity: 'CRITICAL,HIGH'
 
  trivy-fs:
    name: Filesystem & Secret Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      - name: Scan for vulnerabilities and secrets
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          scanners: 'vuln,secret'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'

# hadolint のインストール
# macOS
brew install hadolint
 
# Docker
docker run --rm -i hadolint/hadolint < Dockerfile
 
# 設定ファイル (.hadolint.yaml)

# .hadolint.yaml
ignored:
  - DL3008  # apt-get でバージョン固定しない (alpine では不要)
  - DL3018  # apk でバージョン固定しない
 
trustedRegistries:
  - docker.io
  - ghcr.io
  - gcr.io
 
override:
  error:
    - DL3000  # WORKDIR は絶対パスを使う
    - DL3001  # パイプに関する注意
  warning:
    - DL3042  # pip install に --no-cache-dir を使う
  info:
    - DL3059  # 複数の連続する RUN 命令を統合する

# Grype のインストール
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
 
# イメージスキャン
grype myapp:latest
 
# SBOM からスキャン
grype sbom:sbom.json
 
# JSON 出力
grype myapp:latest -o json > grype-results.json
 
# 重大度でフィルタ
grype myapp:latest --fail-on critical

# Dockerfile (セキュリティ強化版)
 
# ---- ビルドステージ ----
FROM node:20-alpine AS builder
 
WORKDIR /app
 
# 依存関係のみ先にコピー (キャッシュ効率)
COPY package.json pnpm-lock.yaml ./
RUN corepack enable && pnpm install --frozen-lockfile
 
COPY . .
RUN pnpm build
 
# 不要ファイルの削除
RUN pnpm prune --production && \
    rm -rf .git .env* *.md tests/ src/
 
# ---- 本番ステージ ----
FROM node:20-alpine AS production
 
# セキュリティアップデート
RUN apk update && apk upgrade && \
    apk add --no-cache dumb-init && \
    rm -rf /var/cache/apk/*
 
# 非 root ユーザーの作成
RUN addgroup -g 1001 -S nodejs && \
    adduser -S appuser -u 1001 -G nodejs
 
WORKDIR /app
 
# ビルド成果物のみコピー
COPY --from=builder --chown=appuser:nodejs /app/dist ./dist
COPY --from=builder --chown=appuser:nodejs /app/node_modules ./node_modules
COPY --from=builder --chown=appuser:nodejs /app/package.json ./
 
# 非 root ユーザーに切り替え
USER appuser
 
# ヘルスチェック
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
  CMD node -e "require('http').get('http://localhost:3000/health', (r) => { process.exit(r.statusCode === 200 ? 0 : 1) })"
 
# 読み取り専用を示唆 (実行時に --read-only で強制)
VOLUME ["/tmp"]
 
EXPOSE 3000
 
# PID 1 問題の回避 (シグナルの適切な処理)
ENTRYPOINT ["dumb-init", "--"]
CMD ["node", "dist/index.js"]

# Dockerfile (Python セキュリティ強化版)
 
# ---- ビルドステージ ----
FROM python:3.12-slim AS builder
 
WORKDIR /app
 
# 仮想環境を作成 (システム Python との分離)
RUN python -m venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"
 
# 依存関係のインストール
COPY requirements.txt .
RUN pip install --no-cache-dir --upgrade pip && \
    pip install --no-cache-dir -r requirements.txt
 
COPY . .
 
# ---- 本番ステージ ----
FROM python:3.12-slim AS production
 
# セキュリティアップデート
RUN apt-get update && \
    apt-get upgrade -y && \
    apt-get install -y --no-install-recommends tini && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*
 
# 非 root ユーザー
RUN groupadd -g 1001 appgroup && \
    useradd -u 1001 -g appgroup -s /bin/false -M appuser
 
WORKDIR /app
 
# 仮想環境をコピー
COPY --from=builder --chown=appuser:appgroup /opt/venv /opt/venv
COPY --from=builder --chown=appuser:appgroup /app .
 
ENV PATH="/opt/venv/bin:$PATH"
ENV PYTHONDONTWRITEBYTECODE=1
ENV PYTHONUNBUFFERED=1
 
USER appuser
 
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
  CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"
 
EXPOSE 8000
 
ENTRYPOINT ["tini", "--"]
CMD ["gunicorn", "app.main:app", "--bind", "0.0.0.0:8000", "--workers", "4"]

# Dockerfile (Go セキュリティ強化版)
 
# ---- ビルドステージ ----
FROM golang:1.22-alpine AS builder
 
RUN apk add --no-cache ca-certificates git
 
WORKDIR /app
 
COPY go.mod go.sum ./
RUN go mod download && go mod verify
 
COPY . .
 
# 静的バイナリを生成 (CGO 無効)
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
    go build -ldflags="-w -s -X main.version=1.0.0" \
    -o /server ./cmd/server
 
# ---- 本番ステージ (scratch or distroless) ----
FROM gcr.io/distroless/static-debian12:nonroot
 
# CA 証明書 (HTTPS 通信に必要)
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
 
# バイナリのみコピー
COPY --from=builder /server /server
 
USER nonroot:nonroot
 
EXPOSE 8080
 
ENTRYPOINT ["/server"]

# Go アプリの Distroless ビルド
FROM golang:1.22 AS builder
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -o /server .
 
FROM gcr.io/distroless/static-debian12:nonroot
COPY --from=builder /server /server
USER nonroot:nonroot
EXPOSE 8080
ENTRYPOINT ["/server"]

# Java アプリの Distroless ビルド
FROM eclipse-temurin:21-jdk AS builder
WORKDIR /app
COPY . .
RUN ./gradlew bootJar
 
FROM gcr.io/distroless/java21-debian12:nonroot
COPY --from=builder /app/build/libs/app.jar /app.jar
USER nonroot:nonroot
EXPOSE 8080
ENTRYPOINT ["java", "-jar", "/app.jar"]

# Chainguard Images を使った Node.js アプリ
FROM cgr.dev/chainguard/node:latest-dev AS builder
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci --production
COPY . .
RUN npm run build
 
FROM cgr.dev/chainguard/node:latest
WORKDIR /app
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/package.json ./
EXPOSE 3000
CMD ["dist/index.js"]

# セキュリティ強化された docker run
docker run \
  --read-only \                        # 読み取り専用ファイルシステム
  --tmpfs /tmp:noexec,nosuid,size=64m \ # 書き込み可能な一時領域
  --cap-drop ALL \                     # 全 Capability を削除
  --cap-add NET_BIND_SERVICE \         # 必要な Capability のみ追加
  --security-opt no-new-privileges \   # 権限昇格を防止
  --security-opt seccomp=default \     # seccomp プロファイル
  --user 1001:1001 \                   # 非 root ユーザー
  --pids-limit 100 \                   # プロセス数制限
  --memory 256m \                      # メモリ制限
  --cpus 0.5 \                         # CPU 制限
  --network myapp-net \                # カスタムネットワーク (default bridge を使わない)
  --dns 8.8.8.8 \                      # DNS サーバーの明示指定
  --health-cmd "curl -f http://localhost:3000/health || exit 1" \
  --health-interval 30s \
  --health-timeout 5s \
  --health-retries 3 \
  myapp:latest

# docker-compose.yml
services:
  app:
    image: myapp:latest
    read_only: true
    tmpfs:
      - /tmp:noexec,nosuid,size=64m
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    security_opt:
      - no-new-privileges:true
    user: "1001:1001"
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 256M
          pids: 100
    healthcheck:
      test: ["CMD", "node", "-e", "require('http').get('http://localhost:3000/health', (r) => process.exit(r.statusCode === 200 ? 0 : 1))"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    networks:
      - app-net
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
 
networks:
  app-net:
    driver: bridge
    internal: false  # true にすると外部通信を遮断

{
  "defaultAction": "SCMP_ACT_ERRNO",
  "archMap": [
    {
      "architecture": "SCMP_ARCH_X86_64",
      "subArchitectures": ["SCMP_ARCH_X86"]
    }
  ],
  "syscalls": [
    {
      "names": [
        "accept", "accept4", "access", "bind", "brk",
        "chdir", "chmod", "chown", "close", "connect",
        "dup", "dup2", "dup3", "epoll_create", "epoll_create1",
        "epoll_ctl", "epoll_wait", "epoll_pwait",
        "execve", "exit", "exit_group",
        "fchmod", "fchown", "fcntl", "fdatasync",
        "fstat", "fstatfs", "fsync", "ftruncate",
        "getcwd", "getdents", "getdents64", "getegid",
        "geteuid", "getgid", "getpgrp", "getpid", "getppid",
        "getuid", "ioctl", "kill",
        "listen", "lseek", "lstat",
        "madvise", "mkdir", "mmap", "mprotect", "mremap",
        "munmap", "nanosleep", "newfstatat",
        "open", "openat", "pipe", "pipe2", "poll", "ppoll",
        "prctl", "pread64", "prlimit64", "pwrite64",
        "read", "readlink", "readlinkat", "recvfrom", "recvmsg",
        "rename", "rmdir", "rt_sigaction", "rt_sigprocmask",
        "rt_sigreturn", "select", "sendmsg", "sendto",
        "set_robust_list", "set_tid_address",
        "setgid", "setgroups", "setuid",
        "sigaltstack", "socket", "stat", "statfs",
        "symlink", "tgkill", "umask", "uname",
        "unlink", "wait4", "write", "writev"
      ],
      "action": "SCMP_ACT_ALLOW"
    }
  ]
}

# カスタム seccomp プロファイルの適用
docker run --security-opt seccomp=seccomp-profile.json myapp:latest

# pod-security.yaml (Restricted レベル)
apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1001
    runAsGroup: 1001
    fsGroup: 1001
    seccompProfile:
      type: RuntimeDefault
  automountServiceAccountToken: false  # SA トークンの自動マウントを無効化
  containers:
    - name: app
      image: myapp:latest
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop: ["ALL"]
      volumeMounts:
        - name: tmp
          mountPath: /tmp
      resources:
        limits:
          cpu: "500m"
          memory: "256Mi"
        requests:
          cpu: "100m"
          memory: "128Mi"
  volumes:
    - name: tmp
      emptyDir:
        sizeLimit: 64Mi

# Namespace レベルで Pod Security Standards を適用
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    # Restricted レベルを強制
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest
    # Baseline レベルで警告
    pod-security.kubernetes.io/warn: baseline
    pod-security.kubernetes.io/warn-version: latest
    # Privileged レベルで監査ログ
    pod-security.kubernetes.io/audit: privileged
    pod-security.kubernetes.io/audit-version: latest

# ServiceAccount
apiVersion: v1
kind: ServiceAccount
metadata:
  name: myapp-sa
  namespace: production
automountServiceAccountToken: false
 
---
# Role (namespace スコープ)
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: myapp-role
  namespace: production
rules:
  # ConfigMap の読み取りのみ許可
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get", "list", "watch"]
  # Secret の読み取りのみ許可 (特定名のみ)
  - apiGroups: [""]
    resources: ["secrets"]
    resourceNames: ["myapp-secret"]
    verbs: ["get"]
 
---
# RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: myapp-rolebinding
  namespace: production
subjects:
  - kind: ServiceAccount
    name: myapp-sa
    namespace: production
roleRef:
  kind: Role
  name: myapp-role
  apiGroup: rbac.authorization.k8s.io

# NG: シークレットをビルド引数で渡す (レイヤーに残る)
ARG NPM_TOKEN
RUN echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > .npmrc && \
    npm ci && \
    rm .npmrc   # 削除しても前のレイヤーに残っている！
 
# OK: BuildKit のシークレットマウント
# syntax=docker/dockerfile:1
RUN --mount=type=secret,id=npmrc,target=/root/.npmrc \
    npm ci
 
# OK: SSH 鍵のマウント (プライベート Git リポジトリのクローン用)
RUN --mount=type=ssh \
    git clone git@github.com:myorg/private-repo.git

# ビルド時のシークレット渡し
docker build --secret id=npmrc,src=$HOME/.npmrc -t myapp .
 
# SSH 鍵の転送
docker build --ssh default -t myapp .
 
# BuildKit のシークレットマウントを使った pip install
docker build \
  --secret id=pip_conf,src=$HOME/.pip/pip.conf \
  -t myapp .

# Docker Compose でのシークレット
services:
  app:
    image: myapp:latest
    secrets:
      - db_password
      - api_key
    environment:
      DB_PASSWORD_FILE: /run/secrets/db_password
 
secrets:
  db_password:
    file: ./secrets/db_password.txt
  api_key:
    environment: API_KEY

// アプリ側: ファイルベースのシークレット読み取り
import { readFileSync, existsSync } from 'fs';
 
function getSecret(name: string): string {
  // Docker Secrets (ファイルベース) を優先
  const filePath = process.env[`${name}_FILE`];
  if (filePath && existsSync(filePath)) {
    return readFileSync(filePath, 'utf-8').trim();
  }
 
  // Kubernetes Secret (環境変数) にフォールバック
  const envValue = process.env[name];
  if (envValue) {
    return envValue;
  }
 
  throw new Error(`Secret '${name}' not found`);
}
 
const dbPassword = getSecret('DB_PASSWORD');
const apiKey = getSecret('API_KEY');

# Vault Agent Injector を使った Kubernetes 統合
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
spec:
  template:
    metadata:
      annotations:
        # Vault Agent Injector のアノテーション
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/role: "myapp"
        vault.hashicorp.com/agent-inject-secret-db-creds: "secret/data/myapp/db"
        vault.hashicorp.com/agent-inject-template-db-creds: |
          {{- with secret "secret/data/myapp/db" -}}
          export DATABASE_URL="postgresql://{{ .Data.data.username }}:{{ .Data.data.password }}@db:5432/myapp"
          {{- end -}}
    spec:
      serviceAccountName: myapp-sa
      containers:
        - name: app
          image: myapp:latest
          command: ["/bin/sh", "-c"]
          args:
            - source /vault/secrets/db-creds && exec node dist/index.js

# Falco のインストール (Helm)
# helm install falco falcosecurity/falco -n falco --create-namespace
 
# falco-rules.yaml (カスタムルール)
- rule: Container Shell Spawned
  desc: コンテナ内でシェルが起動された
  condition: >
    spawned_process and
    container and
    proc.name in (bash, sh, zsh, ash) and
    not container.image.repository in (allowed_shell_images)
  output: >
    Shell spawned in container
    (user=%user.name container=%container.name
     image=%container.image.repository cmd=%proc.cmdline)
  priority: WARNING
  tags: [container, shell]
 
- rule: Sensitive File Access
  desc: 機密ファイルへのアクセスを検知
  condition: >
    open_read and
    container and
    fd.name in (/etc/shadow, /etc/passwd, /etc/sudoers)
  output: >
    Sensitive file accessed in container
    (user=%user.name file=%fd.name container=%container.name)
  priority: CRITICAL
  tags: [container, filesystem]
 
- rule: Outbound Connection to Suspicious Port
  desc: 不審なポートへの外部接続
  condition: >
    outbound and
    container and
    not fd.sport in (80, 443, 53, 5432, 6379, 9092) and
    not container.image.repository in (allowed_outbound_images)
  output: >
    Unexpected outbound connection
    (user=%user.name container=%container.name
     connection=%fd.name port=%fd.sport)
  priority: WARNING
  tags: [container, network]
 
- rule: Package Manager Execution
  desc: コンテナ内でパッケージマネージャが実行された
  condition: >
    spawned_process and
    container and
    proc.name in (apt, apt-get, yum, dnf, apk, pip, npm) and
    not container.image.repository in (allowed_package_install_images)
  output: >
    Package manager executed in container
    (user=%user.name cmd=%proc.cmdline container=%container.name)
  priority: ERROR
  tags: [container, software_mgmt]

# falco-values.yaml (Helm)
falcosidekick:
  enabled: true
  config:
    slack:
      webhookurl: "https://hooks.slack.com/services/T00000/B00000/XXXXXX"
      channel: "#security-alerts"
      minimumpriority: "warning"
      messageformat: |
        *Priority:* {{ .Priority }}
        *Rule:* {{ .Rule }}
        *Output:* {{ .Output }}
        *Time:* {{ .Time }}

# Gatekeeper のインストール
# helm install gatekeeper gatekeeper/gatekeeper -n gatekeeper-system --create-namespace
 
# ConstraintTemplate: コンテナは root で実行してはならない
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8srequirenonrootuser
spec:
  crd:
    spec:
      names:
        kind: K8sRequireNonRootUser
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package requirenonrootuser
 
        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          not container.securityContext.runAsNonRoot
          msg := sprintf("Container '%v' must set securityContext.runAsNonRoot to true", [container.name])
        }
 
        violation[{"msg": msg}] {
          input.review.object.spec.securityContext.runAsUser == 0
          msg := "Pod must not run as root (UID 0)"
        }
 
---
# Constraint: 適用
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequireNonRootUser
metadata:
  name: require-non-root
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces: ["production", "staging"]
  parameters: {}

# ConstraintTemplate: リソースリミットの必須化
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8srequireresourcelimits
spec:
  crd:
    spec:
      names:
        kind: K8sRequireResourceLimits
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package requireresourcelimits
 
        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          not container.resources.limits.cpu
          msg := sprintf("Container '%v' must set resources.limits.cpu", [container.name])
        }
 
        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          not container.resources.limits.memory
          msg := sprintf("Container '%v' must set resources.limits.memory", [container.name])
        }
 
---
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequireResourceLimits
metadata:
  name: require-resource-limits
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces: ["production"]

# Kyverno ポリシー: 非 root 実行の強制
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-run-as-non-root
spec:
  validationFailureAction: Enforce
  background: true
  rules:
    - name: check-containers
      match:
        any:
          - resources:
              kinds:
                - Pod
              namespaces:
                - production
                - staging
      validate:
        message: "Containers must run as non-root"
        pattern:
          spec:
            containers:
              - securityContext:
                  runAsNonRoot: true
                  allowPrivilegeEscalation: false
 
---
# Kyverno ポリシー: latest タグの禁止
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-latest-tag
spec:
  validationFailureAction: Enforce
  rules:
    - name: validate-image-tag
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: "Image tag 'latest' is not allowed. Use a specific version tag."
        pattern:
          spec:
            containers:
              - image: "!*:latest"

# gitleaks のインストール
brew install gitleaks
 
# リポジトリスキャン
gitleaks detect --source . --verbose
 
# Git 履歴全体のスキャン
gitleaks detect --source . --log-opts="--all"
 
# pre-commit フックとして設定
gitleaks protect --staged

# .gitleaks.toml (設定ファイル)
[allowlist]
  description = "Allowlisted files and patterns"
  paths = [
    '''\.gitleaks\.toml''',
    '''tests/fixtures/''',
    '''\.trivyignore''',
  ]
 
  id = "custom-api-key"
  description = "Custom API Key Pattern"
  regex = '''(?i)api[_-]?key\s*[=:]\s*'"['"']'''
  tags = ["key", "api"]

# NG: root で実行 (デフォルト)
FROM node:20-alpine
WORKDIR /app
COPY . .
CMD ["node", "index.js"]
# -> コンテナ内で root 権限。脆弱性を突かれると
#   ホストファイルシステムにアクセスされるリスク
 
# OK: 非 root ユーザーで実行
FROM node:20-alpine
RUN addgroup -g 1001 -S appgroup && \
    adduser -S appuser -u 1001 -G appgroup
WORKDIR /app
COPY --chown=appuser:appgroup . .
USER appuser
CMD ["node", "index.js"]

# NG: 単一ステージ (ビルドツール + ソースコードが本番イメージに残る)
FROM node:20
WORKDIR /app
COPY . .
RUN npm ci && npm run build
CMD ["node", "dist/index.js"]
# -> gcc, make, python, .git, src/ が全て残る (攻撃面が広い)
 
# OK: マルチステージで本番イメージを最小化
FROM node:20 AS builder
WORKDIR /app
COPY . .
RUN npm ci && npm run build && npm prune --production
 
FROM node:20-alpine
WORKDIR /app
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
USER node
CMD ["node", "dist/index.js"]

# NG: デフォルトの Capability のまま実行
spec:
  containers:
    - name: app
      image: myapp:latest
      # securityContext が未設定 -> 14個の Capability が付与される
 
# OK: 全削除して必要最小限のみ追加
spec:
  containers:
    - name: app
      image: myapp:latest
      securityContext:
        capabilities:
          drop: ["ALL"]
          add: ["NET_BIND_SERVICE"]  # 80番ポート使用時のみ

# NG: SA トークンが自動マウントされる (デフォルト)
spec:
  containers:
    - name: app
      image: myapp:latest
      # /var/run/secrets/kubernetes.io/serviceaccount/token にトークンが存在
      # -> コンテナが侵害された場合、Kubernetes API にアクセスされる
 
# OK: 不要な場合は自動マウントを無効化
spec:
  automountServiceAccountToken: false
  containers:
    - name: app
      image: myapp:latest

# 演習1: 基本実装のテンプレート
class Exercise1:
    """基本的な実装パターンの演習"""
 
    def __init__(self):
        self.data = []
 
    def validate_input(self, value):
        """入力値の検証"""
        if value is None:
            raise ValueError("入力値がNoneです")
        return True
 
    def process(self, value):
        """データ処理のメインロジック"""
        self.validate_input(value)
        self.data.append(value)
        return self.data
 
    def get_results(self):
        """処理結果の取得"""
        return {
            'count': len(self.data),
            'data': self.data
        }
 
# テスト
def test_exercise1():
    ex = Exercise1()
    assert ex.process(1) == [1]
    assert ex.process(2) == [1, 2]
    assert ex.get_results()['count'] == 2
 
    try:
        ex.process(None)
        assert False, "例外が発生するべき"
    except ValueError:
        pass
 
    print("全テスト合格!")
 
test_exercise1()

# 演習2: 応用パターン
from typing import List, Dict, Optional
from datetime import datetime
 
class AdvancedExercise:
    """応用パターンの演習"""
 
    def __init__(self, max_size: int = 100):
        self._items: List[Dict] = []
        self._max_size = max_size
        self._created_at = datetime.now()
 
    def add(self, key: str, value: any) -> bool:
        """アイテムの追加（サイズ制限付き）"""
        if len(self._items) >= self._max_size:
            return False
        self._items.append({
            'key': key,
            'value': value,
            'timestamp': datetime.now().isoformat()
        })
        return True
 
    def find(self, key: str) -> Optional[Dict]:
        """キーによる検索"""
        for item in reversed(self._items):
            if item['key'] == key:
                return item
        return None
 
    def remove(self, key: str) -> bool:
        """キーによる削除"""
        for i, item in enumerate(self._items):
            if item['key'] == key:
                self._items.pop(i)
                return True
        return False
 
    def stats(self) -> Dict:
        """統計情報"""
        return {
            'total_items': len(self._items),
            'max_size': self._max_size,
            'usage_percent': len(self._items) / self._max_size * 100,
            'uptime': str(datetime.now() - self._created_at)
        }
 
# テスト
def test_advanced():
    ex = AdvancedExercise(max_size=3)
    assert ex.add("a", 1) == True
    assert ex.add("b", 2) == True
    assert ex.add("c", 3) == True
    assert ex.add("d", 4) == False  # サイズ制限
    assert ex.find("b")['value'] == 2
    assert ex.remove("b") == True
    assert ex.find("b") is None
    stats = ex.stats()
    assert stats['total_items'] == 2
    print("応用テスト全合格!")
 
test_advanced()

# 演習3: パフォーマンス最適化
import time
from functools import lru_cache
 
# 最適化前（O(n^2)）
def slow_search(data: list, target: int) -> int:
    """非効率な検索"""
    for i in range(len(data)):
        for j in range(i + 1, len(data)):
            if data[i] + data[j] == target:
                return (i, j)
    return (-1, -1)
 
# 最適化後（O(n)）
def fast_search(data: list, target: int) -> tuple:
    """ハッシュマップを使った効率的な検索"""
    seen = {}
    for i, num in enumerate(data):
        complement = target - num
        if complement in seen:
            return (seen[complement], i)
        seen[num] = i
    return (-1, -1)
 
# ベンチマーク
def benchmark():
    import random
    data = list(range(5000))
    random.shuffle(data)
    target = data[100] + data[4000]
 
    start = time.time()
    result1 = slow_search(data, target)
    slow_time = time.time() - start
 
    start = time.time()
    result2 = fast_search(data, target)
    fast_time = time.time() - start
 
    print(f"非効率版: {slow_time:.4f}秒")
    print(f"効率版:   {fast_time:.6f}秒")
    print(f"高速化率: {slow_time/fast_time:.0f}倍")
 
benchmark()