@umacloud/knowledge 1.0.1

package/devops/02-playbooks/docker-compose-playbook.md

@@ -0,0 +1,233 @@
+---
+id: docker-compose-playbook
+title: Docker Compose完整指南
+domain: devops
+category: 02-playbooks
+difficulty: intermediate
+tags: [compose, devops, docker, playbook, 学习路径, 最佳实践, 核心概念, 概述]
+quality_score: 70
+last_updated: 2026-06-15
+---
+# Docker Compose完整指南
+
+## 概述
+Docker Compose是多容器Docker应用定义和运行工具。本指南覆盖服务编排、网络、卷管理和最佳实践。
+
+## 核心概念
+
+### 1. 基础配置
+
+**docker-compose.yml**:
+```yaml
+version: '3.8'
+
+services:
+  web:
+    build: .
+    ports:
+      - "8000:8000"
+    environment:
+      - DATABASE_URL=postgresql://user:pass@db:5432/mydb
+    depends_on:
+      - db
+      - redis
+    networks:
+      - backend
+
+  db:
+    image: postgres:15-alpine
+    environment:
+      POSTGRES_DB: mydb
+      POSTGRES_USER: user
+      POSTGRES_PASSWORD: pass
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    networks:
+      - backend
+
+  redis:
+    image: redis:7-alpine
+    networks:
+      - backend
+
+volumes:
+  postgres_data:
+
+networks:
+  backend:
+```
+
+### 2. 常用命令
+
+```bash
+# 启动服务
+docker-compose up -d
+
+# 查看服务状态
+docker-compose ps
+
+# 查看日志
+docker-compose logs -f
+
+# 停止服务
+docker-compose down
+
+# 重建服务
+docker-compose up -d --build
+
+# 进入容器
+docker-compose exec web /bin/bash
+
+# 运行命令
+docker-compose run web python manage.py migrate
+
+# 扩展服务
+docker-compose up -d --scale worker=3
+```
+
+### 3. 环境变量
+
+```yaml
+services:
+  web:
+    image: myapp
+    environment:
+      - NODE_ENV=production
+      - DB_HOST=${DB_HOST}
+    env_file:
+      - .env
+```
+
+### 4. 卷管理
+
+```yaml
+services:
+  web:
+    volumes:
+      # 命名卷
+      - data_volume:/app/data
+      # 绑定挂载
+      - ./app:/app
+      # 匿名卷
+      - /app/node_modules
+
+volumes:
+  data_volume:
+```
+
+### 5. 网络配置
+
+```yaml
+services:
+  web:
+    networks:
+      - frontend
+      - backend
+
+  db:
+    networks:
+      - backend
+
+networks:
+  frontend:
+  backend:
+    internal: true  # 内部网络
+```
+
+### 6. 健康检查
+
+```yaml
+services:
+  web:
+    image: myapp
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+```
+
+### 7. 资源限制
+
+```yaml
+services:
+  web:
+    image: myapp
+    deploy:
+      resources:
+        limits:
+          cpus: '0.5'
+          memory: 512M
+        reservations:
+          cpus: '0.25'
+          memory: 256M
+```
+
+## 最佳实践
+
+### ✅ DO
+
+1. **使用健康检查**
+```yaml
+healthcheck:
+  test: ["CMD", "curl", "-f", "http://localhost/health"]
+```
+
+2. **明确指定版本**
+```yaml
+image: postgres:15-alpine  # ✅ 好
+image: postgres  # ❌ 差
+```
+
+3. **使用命名卷持久化数据**
+```yaml
+volumes:
+  db_data:
+```
+
+### ❌ DON'T
+
+1. **不要使用latest标签**
+```yaml
+image: myapp:latest  # ❌ 差
+image: myapp:v1.2.3  # ✅ 好
+```
+
+2. **不要在compose中硬编码密码**
+```yaml
+# ❌ 差
+environment:
+  - DB_PASSWORD=mypassword
+
+# ✅ 好
+env_file:
+  - .env
+```
+
+## 学习路径
+
+### 初级 (1周)
+1. 基础配置
+2. 常用命令
+3. 服务管理
+
+### 中级 (1-2周)
+1. 网络配置
+2. 卷管理
+3. 环境变量
+
+### 高级 (2-3周)
+1. 多环境配置
+2. 生产部署
+3. 性能调优
+
+---
+
+**知识ID**: `docker-compose-complete`  
+**领域**: devops  
+**类型**: playbooks  
+**难度**: beginner  
+**质量分**: 92  
+**维护者**: devops-team@umadev.com  
+**最后更新**: 2026-03-28

package/devops/02-playbooks/docker-k8s-production-playbook.md

@@ -0,0 +1,186 @@
+---
+id: docker-k8s-production-playbook
+title: Docker/Kubernetes 生产安全手册
+domain: devops
+category: 02-playbooks
+difficulty: advanced
+tags: [devops, docker, kubernetes, k8s, security, multi-stage, non-root, secrets, scanning, rbac, network-policy, tls, enterprise]
+quality_score: 94
+maintainer: devops-team@umadev.com
+last_updated: 2026-06-14
+---
+
+# Docker/Kubernetes 生产安全手册
+
+> 基于 [Tigera Container Security 2025](https://www.tigera.io/learn/guides/container-security-best-practices/) + [Sysdig 17 Best Practices](https://www.sysdig.com/learn-cloud-native/container-security-best-practices) + [ThinkSys Docker Guide](https://thinksys.com/devops/docker-best-practices/)
+
+## Docker 五大生产原则
+
+### 1. 永远不以 root 运行
+```dockerfile
+# ❌ 默认 root（容器逃逸 = 主机 root）
+FROM node:20
+CMD ["node", "server.js"]
+
+# ✅ 创建非 root 用户
+FROM node:20-alpine
+RUN addgroup -S app && adduser -S app -G app
+USER app                    # 关键！
+CMD ["node", "server.js"]
+```
+
+### 2. 多阶段构建（减镜像 + 减攻击面）
+```dockerfile
+# ✅ 构建工具不进最终镜像
+FROM node:20-alpine AS builder
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci
+COPY . .
+RUN npm run build           # 产物在 dist/
+
+FROM node:20-alpine AS runner
+WORKDIR /app
+RUN addgroup -S app && adduser -S app -G app
+COPY --from=builder /app/dist ./dist
+COPY --from=builder /app/node_modules ./node_modules
+COPY --from=builder /app/package.json ./
+USER app
+CMD ["node", "dist/server.js"]
+# 最终镜像不含 npm/COPY/源码 → 更小更安全
+```
+
+### 3. 密钥不入镜像
+```dockerfile
+# ❌ 密钥硬编码在 Dockerfile（任何人 pull 镜像就泄露）
+ENV DATABASE_URL=postgres://user:pass@db:5432/app
+
+# ✅ 运行时注入（K8s Secret / 环境变量）
+# K8s 部署：
+env:
+  - name: DATABASE_URL
+    valueFrom:
+      secretKeyRef:
+        name: app-secrets
+        key: database-url
+```
+
+### 4. 用最小基础镜像
+```dockerfile
+# ❌ 完整 OS（含 shell/apt/系统工具 → 攻击面大）
+FROM ubuntu:22.04
+
+# ✅ Alpine（5MB）或 Distroless（无 shell）
+FROM node:20-alpine           # Alpine
+# 或
+FROM gcr.io/distroless/nodejs20  # Distroless（连 shell 都没有）
+```
+
+### 5. CI 中扫描漏洞
+```yaml
+# .github/workflows/ci.yml
+- name: Scan image for vulnerabilities
+  uses: aquasecurity/trivy-action@master
+  with:
+    image-ref: app:latest
+    severity: CRITICAL,HIGH
+    exit-code: 1             # 有高危漏洞就 CI 失败
+```
+
+## Kubernetes 生产配置
+
+### Pod 安全上下文
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+spec:
+  template:
+    spec:
+      securityContext:
+        runAsNonRoot: true          # 禁止 root
+        runAsUser: 1000
+        fsGroup: 2000
+        seccompProfile:
+          type: RuntimeDefault       # 默认 Seccomp 配置
+      containers:
+      - name: app
+        image: app:latest
+        securityContext:
+          allowPrivilegeEscalation: false   # 禁止提权
+          readOnlyRootFilesystem: true       # 只读文件系统
+          capabilities:
+            drop: [ALL]                     # 丢掉所有 Linux capabilities
+            # 只 add 必需的，如：add: [NET_BIND_SERVICE]
+        resources:
+          limits:
+            cpu: 500m
+            memory: 512Mi
+          requests:
+            cpu: 100m
+            memory: 128Mi
+```
+
+### Network Policy（零信任网络）
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: app-network-policy
+spec:
+  podSelector:
+    matchLabels:
+      app: api-server
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress:
+  - from:
+    - podSelector:
+        matchLabels:
+          app: frontend      # 只允许前端 Pod 访问
+    ports:
+    - protocol: TCP
+      port: 3000
+  egress:
+  - to:
+    - podSelector:
+        matchLabels:
+          app: postgres      # 只允许访问数据库
+    ports:
+    - protocol: TCP
+      port: 5432
+  - to:
+    - namespaceSelector: {}  # 允许 DNS
+    ports:
+    - protocol: UDP
+      port: 53
+```
+
+### RBAC（最小权限）
+```yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: app-role
+rules:
+- apiGroups: [""]
+  resources: ["configmaps"]
+  verbs: ["get", "list"]     # 只读，不写
+# 不用 verbs: ["*"]
+```
+
+## 生产检查清单
+
+- [ ] 容器以非 root 运行（USER 指令）
+- [ ] 多阶段构建（最终镜像无构建工具）
+- [ ] 基础镜像是最小化（Alpine/Distroless）
+- [ ] CI 有漏洞扫描（Trivy/Grype）
+- [ ] 密钥用 K8s Secret / Vault（不入镜像）
+- [ ] readOnlyRootFilesystem: true
+- [ ] capabilities.drop: [ALL]
+- [ ] allowPrivilegeEscalation: false
+- [ ] Network Policy 限制 Pod 间通信
+- [ ] Resource limits 设置（CPU + memory）
+- [ ] RBAC 最小权限（不用 cluster-admin）
+- [ ] TLS 加密所有通信
+- [ ] 镜像用固定 tag（不用 :latest）