Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 27 Next »

Table of contents


Overview


Here we will explain the steps to build the iPRO Camera SDK app using the Azure IoT Edge container and check its operation. Also, in this tutorial, the SDK installation directory is described as ${SDK_DIR}.

This tutorial only supports SDK ver.2.00 or later. Please note that it cannot be used with SDK ver.2.00 or lower.

Operation confirmation procedure


Create a new IoT Edge Solution on Visual Studio Code

The following describes the case where the sample app to be referenced is skeleton_sample_app for the C version, additional_info_sample_app for the Python version, and test_app for the Edge Solution to be created. Please note that the Edge Solution name must be in all lowercase letters. Please see below for details.
https://docs.docker.com/reference/cli/docker/image/tag/

Description of C version/Python version application

The operation confirmation method for both the C version and Python version of the application is almost the same. I will explain using the C version as an example, and the different parts will be explained as appropriate. Also, the application path is as follows, so please read it as appropriate.

C version app path
${SDK_DIR}/src/adamapp

Python version app path
${SDK_DIR}/src/adamapp-py

Launch Visual Studio Code directly under [SDK folder].

cd ${SDK_DIR}
code .

 

Copy the ”${SDK_DIR}/src/adamapp/skeleton_sample_app” folder into the same folder.

20240131-120213.png

Rename the copied folder to test_app.

Rename the "skeleton_sample_app" folder in [copied folder]/container/modules to test_app.

The folder name must be all lowercase letters like test_app for it to work. Please see below for details.
https://docs.docker.com/reference/cli/docker/image/tag/

Right-click the folder (test_app) copied from Visual Studio Code's EXPLORER and select "Find in Folder..." to display the SEARCH window.

Search for "skeleton_sample_app" and replace everything with "test_app". The targets are as follows.

  • ${SDK_DIR}\src\adamapp\test_app\container\deployment.template.json

  • ${SDK_DIR}\src\adamapp\test_app\container\modules\test_app\module.json

Enter the information for the container registry to which you want to push the created image.

This document uses Azure Container Registry administrator login credentials to speed up development and testing. In production environments, we recommend using least-privilege authentication options like service principals or repository-scoped tokens. Please see here for details.

Log in to Azure portal(Cloud Computing Services | Microsoft Azure) and select the container registry you want to target. The screen below is an example.

20240131-120214.png

Display "Settings" - "Access Keys" from the left menu.

20240131-120215.png

Based on the information displayed, enter the following:

  • ${SDK_DIR}\src\adamapp\test_app\container\deployment.template.json
    Enter “registryCredentials” in the above file as follows. "Container Registry Name" is the "Registry Name" of Azure Portal in lower case (same as the string before .azurecr.io in "Login Server").

    "registryCredentials": {
      "[container registry name]": {
        "username": "$CONTAINER_REGISTRY_USERNAME_[container registry name]",
        "password": "$CONTAINER_REGISTRY_PASSWORD_[container registry name]",
        "address": "[login server]"
      }
    }

    For example, if the container registry name is “iprocv5xcontainerregistry” and the container registry login server is “iprocv5xcontainerregistry.azurecr.io”, it will be as follows.

     

  • ${SDK_DIR}\src\adamapp\test_app\container\modules\test_app\module.json
    Enter “repository” in the above file as follows.

    "repository": "[login server]/test_app"

    If the container registry login server is "iprocv5xcontainerregistry.azurecr.io", it will be as follows.

  • ${SDK_DIR}\src\adamapp\test_app\container
    Create an .env file in the directory, write the container registry user name and password, and save it.

    CONTAINER_REGISTRY_USERNAME_[container registry name]=[user name]
    CONTAINER_REGISTRY_PASSWORD_[container registry name]=[password]

    An example is shown below.

    20240131-120216.png
20240123-103105.png

Coding the app

Now code as you like on Visual Studio Code. If you copy skeleton_sample_app etc., the source file name will be the one before copying (skeletonSampleApp.cpp for skeleton_sample_app), so please rename it if necessary. Below is an example.

Before
${SDK_DIR}\src\adamapp\test_app\skeletonSampleApp.cpp
After
${SDK_DIR}\src\adamapp\test_app\testApp.cpp

 

Please also modify SRC_FILES in Makefile as necessary. Below is an example.

${SDK_DIR}\src\adamapp\test_app\Makefile
Before
SRC_FILES=	skeletonSampleApp.cpp
After
SRC_FILES=	testApp.cpp

Please also modify PROG_NAME in Makefile, APPLICATION in configuration.txt, and APPLICATION_NAME in deployment.template.json as necessary. Below is an example.

${SDK_DIR}\src\adamapp\test_app\Makefile
Before
PROG_NAME= SkeletonSampleApp
After
PROG_NAME= TestApp

${SDK_DIR}\src\adamapp\test_app\configuration.txt
Before
APPLICATION	SkeletonSampleApp
After
APPLICATION	TestApp

${SDK_DIR}\src\adamapp\test_app\container\deployment.template.json
Before
"APPLICATION_NAME=SkeletonSampleApp"
After
"APPLICATION_NAME=TestApp"

  

Build the app

When building, use the built-in functionality of the Azure IoT extension. In Visual Studio Code's Explorer Right-click on "${SDK_DIR}\src\adamapp\test_app\container\deployment.template.json" to display the build menu.

Select “Build IoT Edge Solution”. This operation only performs a build.

For your first build, you will be asked to log in to your container registry. The following is an example when the container registry is "iprocv5xcontainerregistry.azurecr.io".

ERROR: failed to solve: iprocv5xcontainerregistry.azurecr.io/cadamappbase:0.0.2: failed to authorize: failed to fetch anonymous token: unexpected status: 401 Unauthorized

At this time, enter the following command on the Visual Studio Code terminal.

docker login iprocv5xcontainerregistry.azurecr.io

Then enter the Username and Password that are displayed. Enter the container registry user name and password.

20240131-120217.png

Username: [user name]
Password: [password]

Login Succeeded is displayed, the login is successful.

Next, right-click "${SDK_DIR}\src\adamapp\test_app\container\deployment.template.json" and Select “Build and Push IoT Edge Solution”. This operation builds and pushes to the container registry.

The build is done by running Docker buildx build as described in the Dockerfile.arm64v8 file located under “${SDK_DIR}\src\adamapp\test_app\”. The environment name (arm64v8) after Dockerfile. is the architecture selected in the above step. (You can see the current architecture at the bottom of Visual Studio Code)

20240124-110904.png

Check the built image

If the build is successful, you can check the existence of the image with docker images. Below is an example.

$ docker images
REPOSITORY                                                             TAG             IMAGE ID       CREATED          SIZE
iprocv5xcontainerregistry.azurecr.io/azureiot/test_app  0.0.5-arm64v8   f1772ccfed77   35 minutes ago   91.4MB

   

Deploy to camera

Select the device you want to deploy from under "AZURE IOT HUB" in the bottom left, right-click and select "Deploy to one IoT Edge" to deploy it to the camera. What to deploy Follows "${SDK_DIR}\src\adamapp\test_app\container\deployment.template.json".

20240124-110905.png

A dropdown will appear at the top of Visual Studio Code, so select the following:
${SDK_DIR}\src\adamapp\test_app\container\config\deployment.arm64v8.json

20240124-110906.png

Deployment Succeeded is displayed, the deployment is successful.

20240124-110907.png

Check runtime status on Azure

Log in to the Azure portal(Cloud Computing Services | Microsoft Azure) and select the IoT Edge device you added on the IoT Hub - IoT Edge screen.

20240131-120218.png

Check the runtime status of the deployed app shown at the bottom of the screen. If it is "running", no error has occurred. If "Error" is displayed, an error message will be displayed when you select it, so please debug it.

20240131-120219.png

The runtime status will be "Error" for a while after deployment. It takes time to become "running". However, the amount of time required to become "running" depends on the app.

Check the operation of the app

Access the URL below with a PC that can connect to the camera.

http://[Camera local IP address]/cgi-bin/cadam.cgi?methodName=getApplicationList

The camera response will be displayed. Below is an example.

{
    "appCount": "1",
    "limitationMode": "Shared",
    "maxAppCount": "9",
    "appList": [
        {
            "appType": "0",
            "funcId": "0000FF01",
            "appInfo": {
                "installId": "124B569A",
                (中略)
}

Use the information marked "installId": "124B569A",.

Access the URL below.

http://[Camera local IP address]/cgi-bin/cadam.cgi?Language=1&methodName=sendDataToAdamApplication&installId=[installId]&s_appDataType=0&s_appData=e3tMYW5ndWFnZToxfX0%3D

If the camera's IP address is 192.168.100.33, "installId": "124B569A",, it will be as follows.

http://192.168.100.33/cgi-bin/cadam.cgi?Language=1&methodName=sendDataToAdamApplication&installId=124B569A&s_appDataType=0&s_appData=e3tMYW5ndWFnZToxfX0%3D

You can check the app operation as below. Below is an example of running skeleton_sample_app.

20240124-110910.png

Controlling Container version Adamapp using Azure IoT Explorer


It is possible to control and check the Container version of Adamapp using Azure IoT Explorer published by Microsoft. The following describes the installation and initial settings of Azure IoT Exporlor.

Install

Follow Install and use Azure IoT explorer - Azure IoT | Microsoft Learn and install Azure IoT Explorer on your PC.

 

Initial setting

When you start Azure IoT Explorer, the following initial screen will appear, so select "Connect via IoT Hub connection string".

Select “Add connection”.

addconection.png

Visit “Cloud Computing Services | Microsoft Azure” and select the IoT Hub you want to connect to. In the example below, CV5xIoTHub2 is selected.

20240202-170000.png

Select Security Settings - Shared Access Policies from the left menu.

Click “iothubowner” from the Manage “Shared Access Policies” list.

20240202-170001.png

Press the copy button to the right of Primary Connection String to copy the string to your clipboard.

20240202-170002.png

Paste it into the Connection string frame of Azure IoT Explorer and press the Save button.

AzureIoTExplorer1.PNG

 

The IoT Hub information will be loaded and a device list will be displayed.

image-20240130-001330.png

Select the device you want to check from the displayed device (camera) list.

 

Checking the setting values with ModuleTwin

The settings values listed in the app settings (AppPrefs.json) can be checked from the cloud using Azure IoT's ModuleTwin mechanism.

Please refer to Understand Azure IoT Hub module twins | Microsoft Learn for ModuleTwin.

 

Select the device (camera) you want to check in Azure IoT Explorer. Select “Module identities” from the left menu.

image-20240130-002714.png

A list of containers (Modules) currently running on the camera is displayed. Click the container name whose settings you want to check.

$edgeAgent and $edgeHub are the default containers for operating as an Azure IoT Edge Device.
Please refer to Learn how the runtime manages devices - Azure IoT Edge | Microsoft Learn for details.

The page for the target container will be displayed. Select “Module twin” from the left menu again.

Information about the target container is displayed in json format. The information written in appPrefs.json will be displayed in “properties”.”reported”.”aplField”.”preference”.

Setting values are read-only.

 

Setting the operation schedule

Use ModuleTwin to set the time zone in which the application will run.

The Container version of AdamApp cannot be controlled using the camera's schedule settings.

Similar to the "Checking settings using ModuleTwin" chapter, the Module Twin information for the target container is displayed.
Set the schedule in “properties”.”desired”.“scheduleField” according to the following format.
The format is below. Three fields represent one setting.

Day of the week setting 1, Inference start time 1, Inference end time 1, Day of the week setting 2, Inference start time 2, Inference end time 2,...

The specifications of each item are as follows.

item

meaning

format

note

Day of the week setting

Specify the days of the week when the app will run.

Set one of the following.

“every-day”

“Sun”

“Mon”

“Tue”

“Wed”

“Thu”

“Fri”

“Sat”

By setting the inference start time to "00:00" and the inference end time to "23:59", it is possible to operate 24 hours a day within the specified day.

Inference start time

Specify the time when the app starts working.

“hh:mm”

Can be set from 00:00 to 23:59.

Inference end time

Specify the time when the app's operation ends.

“hh.mm”

Can be set from 00:00 to 23:59. The end timing is determined at a timing outside of this time. (Example: If it is set to 02:15, it will stop after 2:16:00.)

A setting example is shown below.

スケジュール.PNG

In this case, it will be set to operate from Sunday to Thursday, from 08:00:00 to 20:00:59 on Saturday, and from 03:00 to 23:59:59 on Friday.

  • After entering the settings, press "Save" at the top of the screen to apply the settings to the camera.

  • Up to 8 can be set.

  • If it is within any of the configured times, Container AdamApp will work.

  • If the inference end time is later than the inference start time, the inference end time represents the next day.

  • If scheduleField is empty, it will always operate.

  • If the information is incorrect, the application will not start.

  • Stop/start decisions are made at 15 second intervals. Therefore, the start and stop times will be delayed by up to 15 seconds.

 

Sending telemetry data from the device via cloud communication

Sending telemetry data

  • Telemetry data can be sent from the device via cloud communication by calling the ADAM_SendTelemetry() function, which is valid only for Container AdamApp.

  • Please specify values in JSON format for the arguments of this API. Please see the API specification for details.

  • Device-to-cloud communication has a limit on the number of times it can communicate depending on the Azure IoT Hub settings. Please check here for more details.

  • To control communication, sending is set to OFF by default. In order to send to the cloud, you must first turn on the sending function.

  • There are two ways to turn on the transmission function: Module direct method and Module twin desired property. Please see below.

 

How to turn on using module direct method

Select the target Container Adamapp in Azure IoT Explorer.

Select "Module direct method" from the left menu. You can send a direct method on the screen below.

image-20240205-111900.png

 
Enter the method name “setTelemetry” in the Method name field.
Enter the transmission data in JSON format in the Payload field as follows.

{"telemetry": true}

 

When you press "Invoke method", a direct method will be executed for the camera.

The results will be displayed in a pop-up. If the status is 200, it is successful.

image-20240130-005358.png

 

How to set with Module twin desired property

Display the Module twin of the target Container Adamapp in Azure IoT Explorer.
Set as follows in “properties”.”desired”.”aplField”.

"aplField": {
  "telemetry": true
}

 

Click “Save” at the top of the screen to apply the changes.

  • If you want to stop sending, please set “telemetry” to false.

  • For Module twin, it takes a few seconds to 10 seconds for the settings to be reflected.

  • Module twin works to always synchronize the settings with the camera.
    Therefore, if any telemetry settings remain in the desired property, they will override the settings in the Module direct method.
    To enable the Module direct method setting, set “telemetry”: ““ and delete the item.

 

How to check the settings

Setting values can be checked with Module twin.
Check the value of “properties”.”reported”.”aplField”.”azureSettings”.”telemetry”.

moduletwin2.PNG

 

Checking received telemetry data

Select the target Container Adamapp in Azure IoT Explorer.

Select "Telemetry" from the left menu.

Press the "Start" button. The device will be waiting to receive telemetry data.

When the app receives telemetry sent with ADAM_SendTelemetry(), it will be displayed in the window.

The string set in ADAM_SendTelemetry will be set as the value of the payload key.

image-20240130-042311.png

 

How to check the log


App log

You can check messages output by ADAM_DEBUG_PRINT() within the app and logs output by libraries linked from the app. You can also check if there is an error.

  • Log in to Azure portal(Cloud Computing Services | Microsoft Azure).

  • Select the target IoT Hub.

  • Select the target camera from "Device Management" and "IoT Edge" on the left.

  • From the list of modules below, click the "Runtime Status" link for the app name you want to view logs for.

Err.png

Container Adamapp logs cannot be checked with UDPLog.

 

camera pflog

By checking the log in the camera, you can also analyze the behavior when Container Adamapp is not working properly. Logs can be obtained by clicking the execution button below.

20240205-113700.png

Among the multiple log files, we will introduce the log files that are most related to Container Adamapp.

  • cadam (files with file names starting with pf_cadam, pf_cadamCgi) cadam is a process that manages Container Adamapp.

  • Azure IoT Edge runtime (files whose names start with pf_aziot-certd, pf_aziot-edged, pf_aziot-identityd, pf_aziot-keyd)Azure IoT Edge runtime communicates with Azure IoT Hub.

  • Docker (files with file names starting with pf_docker, pf_containerd, pf_opa) Logs related to Docker operations. opa is used for security checks, and if the created deployment manifest contains content that violates the camera's security policy, a log will be output to this file.

Enhance Security Level of your Container


This article describes techniques for strengthening container security when developing container applications.

Enhancing the security of containers is important to gain the trust of all stakeholders, including end users, and society. Addressing security threats is essential to protecting the data and privacy of those stakeholders and yourself, and building business trust. Using container images with weak security increases the associated risks and can lead to a loss of trust among stakeholders and society. Additionally, if a security issue occurs, you will be required to take action, which could result in huge losses.

The table below is an example of security measures required when developing container apps. It is not a matter of implementing all or just one of the measures; instead, it is necessary to consider what measures to take in combination and to what degree, taking into account trade-offs such as security risks and costs. This document explains only some of these measures, but for details and other measures, we ask that you investigate best practices and consider actual responses.

Examples of Security Measures in Container Apps Development

No.

Security measures

Explanation

1

Select base image

Choose a lightweight, reliable base image. Consider using official or security-enhanced images. i-PRO's SDK provides base images, so please use them unless you need additional information.

2

Image vulnerability scan

Regularly scan container images with tools to identify and remediate vulnerabilities.

3

Creating a secure Dockerfile

Create Dockerfile securely. Don't install unnecessary packages, use ADD instead of COPY, minimize user privileges, etc. Many of these practices can be detected by the vulnerability tools listed above.

4

Applying security context

Minimize risk by setting appropriate permissions and resource limits on your containers. The i-PRO camera restricts these settings, and an error will occur if you try to start the container with settings outside the permitted range. To avoid this error, please use the template settings provided by i-PRO.

5

Container network security

Configure your network settings appropriately and avoid opening unnecessary ports. It also applies security policies to communication between containers.

6

Logging and monitoring

Monitor containers and collect logs to quickly detect anomalies and security incidents. It is necessary to implement output logging with an appropriate amount and content.

7

Confidential data measures

Avoid keeping sensitive data inside containers. If you want to handle sensitive data or safely manage application settings, you need to take measures such as using a secure storage solution. The i-PRO camera provides a data storage environment using named volumes as a method.

8

CI/CD pipeline security

We perform security checks at each stage of build, test, and deployment to detect and fix unauthorized operations and vulnerable code. This includes using the vulnerability scanning tools mentioned above. Set up appropriate access controls in your CI/CD pipeline and adhere to security best practices.

9

Creating and managing SBOM

Create and manage SBOM for vulnerability management and supply chain risk management. We recommend that you understand the OSS included in the image.

 

Run Vulnerability Checker against your Image

One way to strengthen container security is to use tools to extract vulnerabilities in container images and remove or fix them as much as possible.

Below, we will explain an example of using Trivy and Dockle, two OSS tools for detecting vulnerabilities in container images, to extract vulnerabilities in container images and strengthen security.

The example in this section uses Trivy and Dockle to extract vulnerabilities in container images, but please choose the appropriate tools and methods depending on the convenience and purpose of your development environment. In addition, each company is responsible for checking the license and usage conditions of each tool before making decisions regarding its use.

コンテナアプリの開発フローと、その中に脆弱性の抽出および対処を組込んだ例を下図に示します。脆弱性の抽出および対処は、早い段階から開発フローの中に組込み、実施することが推奨されます。最低限、イメージが製品リリースされる前の、実際の本番環境にデプロイされる前に必ず実施されるべきです。

本作業は、セキュリティに関するトレードオフの問題でもあります。抽出および対処にかかる時間や費用、頻度を考慮しなければなりません。しかし、セキュリティ上のリスクを最小限に抑えるために、脆弱性の抽出および対処は定期的に実施することが推奨されます。

20240219-153300.png

 

本図の開発フローの例では、

  • コンテナイメージのビルド “Build Container Image” の工程の直後に、

  • ツールによる脆弱性の抽出と設計者による対応判定 “Check & Judge Vulnerability” を実施し、

  • 次にその判定で対応必要としたものに対し実際に処置をする “Modify Vulnerability” を実施する、

という例を示しています。

脆弱性抽出ツールはTrivyとDockleの2つ両方を使用する例を示しています。これら両方を使用する理由は、各ツールの抽出できる脆弱性の範囲が相異なるためです。Trivyは主にパッケージの脆弱性を抽出し、Dockleは例えば不要なファイルの検出や設定の不備の検出など、主にシステム関連の脆弱性を抽出します。両方のツールを使用することで、より包括的なコンテナイメージのセキュリティチェックを実施できます。これら2つのツールの使用方法の概略については以降の節で記述します。

また、本図では脆弱性チェックの対象として、自身の開発プロダクトであるアプリコンテナイメージだけでなく、その開発途中でマルチビルド等の目的でベースとして使用するコンテナイメージ(例: Debian の公式イメージなど) についても対象としています。その理由は使用するパッケージに対しての脆弱性を漏れなく調べるためなのですが、詳細は改めてTrivyの説明の節において記述します。

 

Trivy: Comprehensive Vulnerability Scanner

Trivyは、コンテナイメージやファイルシステムに存在する脆弱性を検出するオープンソースのスキャナです。主にOSパッケージやプログラミング言語のライブラリに関連する脆弱性を対象にしています。TrivyはAqua Security社によって開発・メンテナンスされており、コンテナ開発者にとって信頼性の高いツールの一つです。

Trivy の使い方の基本例を以下に示します。

(1)  Install Trivy:

まず、Trivy をインストールします。Trivyのリリースページから最新版のバイナリをダウンロードできます。下記リンクからTrivyのリリースページにアクセスしてください。

https://github.com/aquasecurity/trivy/releases

リリースページには、Linux、macOS、Windowsなどの各プラットフォーム向けのバイナリが用意されています。自分の環境に合ったバイナリを選択し、ダウンロードしてください。また、Trivyの公式ドキュメントには、各プラットフォームでのインストール方法が詳細に記載されていますので、そちらも参考にしてください。

Trivy は定期的に更新されていますので、最新版をインストールして使用するようにしてください。

(2)  Run Trivy:

インストールが完了したら、コマンドラインからTrivyを実行して、対象となるコンテナイメージの脆弱性をスキャンします。以下のコマンドは、your-image というコンテナイメージをスキャンする例です。

buildhost$ trivy image your-image

絞り込みを行う際は必要に応じて、Trivy のオプションを使用してスキャン対象や表示内容をカスタマイズできます。例えば、特定の重要度 (後述) 以上の脆弱性のみを表示する場合は、以下のようなコマンドを使用できます。

buildhost$ trivy image --severity CRITICAL,HIGH your-image

(3)  Check the result and determine how to deal with:

スキャンが完了すると、Trivy は検出された脆弱性の一覧を表示します。脆弱性の詳細や重要度(CRITICAL、HIGH、MEDIUM、LOW、UNKNOWN)が示され、修正が必要な箇所を特定しやすくなります。この結果をもとに、影響度などを加味しながらどれをどう対処していくのかを決定していきます。

参考で、以下に公式の ubuntu のイメージに対し trivy を実行した例 (オプション指定無し) の抜粋を示します。(実行例は Trivy は 0.38.3 を使用しています。)

 

Example execution of trivy: target image = ubuntu

buildhost$ trivy image  ubuntu:latest

2023-02-22T15:23:36.453+0900   INFO     Vulnerability scanning is enabled

<<<<........ SNIP ........>>>>

2023-02-22T15:23:43.579+0900   INFO     Detected OS: ubuntu

2023-02-22T15:23:43.580+0900   INFO     Detecting Ubuntu vulnerabilities...

2023-02-22T15:23:43.596+0900   INFO     Number of language-specific files: 0

 

ubuntu:latest (ubuntu 22.04)

============================

Total: 31 (UNKNOWN: 0, LOW: 16, MEDIUM: 14, HIGH: 1, CRITICAL: 0)

 

+---------------+---------------+----------+--------------+------------+---------------------------------------+

|    Library    | Vulnerability | Severity | Install Ver   | Fixed Ver  | Title                                   |

+---------------+---------------+----------+--------------+------------+---------------------------------------+

| bash          | CVE-2022-3715 | LOW      | 5.1-6ubuntu1 |              | bash: a heap-buffer-overflow  |

|                 |                |           |                |              | in valid_parameter_transform  |

|                 |               |            |                |              | https://avd.aquasec.com/nvd/ |

|                |               |            |                |              | cve-2022-3715                          |

+---------------+---------------+----------+--------------+------------+---------------------------------------+

| coreutils     | CVE-2016-2781 |            | 8.32-4.1      |             | coreutils: Non-privileged session can |

|                |                 |           | ubuntu1      |              | escape to the parent session in chroot|

|                 |                 |           |                |             | https://avd.aquasec.com/nvd/            |

|                |                |            |                |             | cve-2016-2781                          |

<<<<........ SNIP ........>>>>

+---------------+---------------+----------+--------------+------------+---------------------------------------+

| libssl3      | CVE-2023-0286  | HIGH    | 3.0.2-0       | 3.0.2-0     | There is a type confusion               |

|                |                 |            | ubuntu1.7    | ubuntu1.8| vulnerability relating to X.400        |

|                |                 |           |                |              | address proc ...                       |

(4)  Note for use:

ここで、Trivyにかけるイメージについて一つ注意点があります。Trivy はパッケージの脆弱性をスキャンする際にパッケージ情報を参照しています。しかし、コンテナイメージのビルドプロセスによっては、パッケージ情報が最終プロダクトであるコンテナイメージに含まれないことがあります。この場合、Trivy がパッケージ脆弱性の検出に関連する情報を取得できず、その機能を利用できない可能性があります。

コンテナ開発者としては、Trivy を適切に活用するために、コンテナイメージにパッケージ情報を含めるか、あるいは Trivy のスキャン対象となるよう別の方法でパッケージ情報を提供することが重要です。例えば、Dockerfile の RUN コマンドでパッケージのインストールとクリーンアップを同時に行っている場合、パッケージ情報がコンテナイメージに含まれないことがあります。このような状況では、Trivy の利用に制限が生じるため、必要に応じてビルドプロセスを調整することが望ましいです。

一手段として、ベースとして使用したコンテナイメージにはパッケージ情報を残したままにしておき、そのイメージに対して Trivy を実行する方法があります。最終プロダクトのコンテナに取り込む対象物は開発者が把握しているはずですので、その対象物に対応するパッケージの脆弱性情報のみを Trivy の実行結果から抽出すればよいわけです。

以上、Trivy のようなツールを利用してコンテナイメージに含まれる脆弱性を定期的にチェックし、セキュリティリスクを低減させることが重要です。また、CI/CDパイプラインにTrivyを組み込むことで、自動化された脆弱性検出を実現し、開発プロセス全体のセキュリティを向上させることができます。

 

Dockle: Container Image Security Linter

Dockle は、コンテナイメージのセキュリティベストプラクティスに基づいて、潜在的な問題を特定するオープンソースのツールです。Dockleは、Dockerfile やイメージ設定など、主にシステム関連の脆弱性を検出します。GoodwithTech 社によって開発・メンテナンスされており、Trivy と同様にコンテナ開発者にとって有益なツールの一つです。

Dockle の使い方の基本例を以下に示します。

(1)  Install Dockle:

まず、Dockle をインストールします。Dockle のリリースページから最新版のバイナリをダウンロードできます。下記リンクから Dockle のリリースページにアクセスしてください。

https://github.com/goodwithtech/dockle/releases

リリースページには、Linux、macOS、Windowsなどの各プラットフォーム向けのバイナリが用意されています。自分の環境に合ったバイナリを選択し、ダウンロードしてください。また、Dockle の公式ドキュメントには、各プラットフォームでのインストール方法が詳細に記載されていますので、そちらも参考にしてください。

(2)  Run Dockle:

インストールが完了したら、コマンドラインから Dockle を実行して、対象となるコンテナイメージのセキュリティベストプラクティスをチェックします。以下のコマンドは、your-image というコンテナイメージをチェックする例です。

buildhost$ dockle your-image

絞り込みを行う際は必要に応じて、Dockle のオプションを使用してチェック対象や表示内容をカスタマイズできます。例えば、特定のチェック ID (後述) を無視する場合は、以下のように実行します。

buildhost$ dockle --ignore CIS-DI-0001 your-image

(3)  Check the result and determine how to deal with:

チェックが完了すると、Dockle は検出された問題の一覧を表示します。各問題には、CIS(Center for Internet Security)ベンチマークに基づいたチェック ID が付与されており、対処すべき箇所を特定しやすくなります。この結果をもとに、影響度などを加味しながらどれをどう対処していくのかを決定していきます。

参考で、以下に Azure IoT Edge のサンプルアプリケーションのイメージに対し Dockle を実行した例 (オプション指定無し) の抜粋を示します。

 

Example execution of Dockle: target image = azureiotedge example application

buildhost$ dockle  mcr.microsoft.com/azureiotedge-simulated-temperature-sensor:1.0

INFO     - CIS-DI-0005: Enable Content trust for Docker

  • export DOCKER_CONTENT_TRUST=1 before docker pull/build

INFO     - CIS-DI-0006: Add HEALTHCHECK instruction to the container image

  • not found HEALTHCHECK statement

INFO     - CIS-DI-0008: Confirm safety of setuid/setgid files

  • setuid file: urwxr-xr-x bin/su

  • setuid file: urwxr-xr-x usr/bin/chsh

           <<<<........ SNIP ........>>>>

  • setgid file: grwxr-xr-x sbin/unix_chkpwd

INFO     - DKL-LI-0003: Only put necessary files

  • unnecessary file : app/docker/linux/arm64v8/base/Dockerfile

  • unnecessary file : app/docker/linux/arm32v7/base/Dockerfile

           <<<<........ SNIP ........>>>>

  • unnecessary file : app/docker/windows/arm32v7/base/Dockerfile

以上、Trivy と同様に Dockle のようなツールを利用してコンテナイメージに含まれるシステム関連の問題を定期的にチェックし、セキュリティリスクを低減させることが重要です。また、CI/CD パイプラインに Dockle を組み込むことで、自動化されたセキュリティベストプラクティスのチェックを実現し、開発プロセス全体のセキュリティを向上させることができます。

 

Force-Limit on Access to Host Resources

セキュリティ上の理由から、i-PROカメラ上で動作するコンテナはアクセス可能なi-PROカメラのホスト側の権限やリソースが強制的に制限されています。Docker API に対し、i-PROに許可されていない権限やリソースの場所、範囲外の値のオプションを指定したコンテナを起動しようとした場合、ホスト側のチェック機構がそれら要求を拒否する仕組みが搭載されています (下記の図を参照)。

20240219-153301.png

 

上記の制約下において、i-PROが許可しているオプション一式が事前設定されているテンプレートを SDK のビルド環境にて提供しています。このテンプレートにはコンテナアプリケーションが起動許可されるために必要かつ十分な設定となっており、上記のような権限やリソースに関する設定は変更せずにそのまま使用可能となっています (コンテナ名などの個別対応が必要なものを除く)。開発されるコンテナアプリケーションからアクセスが必要な権限やリソースに対して、上記テンプレートに事前設定されていない場合や、ご自身で追加、変更した設定がi-PROカメラのホスト側から拒否される場合には、設計、設定の見直しをお願いします。

 

Checkpoints if things don't work in the WSL environment


If it does not work in WSL environment, please check the following.

  • The following must be enabled in the Visual Studio Code "LOCAL" extension

    • Dev Containers

    • Remote - SSH, Remote - SSH: Editing Configuration FIles, Remote - Tunnels, Remote Development, Remote Explorer

    • WSL

  • The following must be enabled in Visual Studio Code's "WSL: UBUNTU-20.04" extension:

    • Azure Account

    • Azure IoT Edge

    • Azure IoT Hub

  • "WSL: Ubuntu-20.04" is displayed at the bottom left of the Visual Studio Code screen.

  • If permission denied is displayed in Build IoT Edge Solution, check whether the current user has access rights to the target directory.

    sudo chown -r ipro:ipro [development directory]
    ※ipro:ipro is an example, so please set it according to each environment.

    Run the above to change the owner.

 

About trademarks

We will post about the trademarks used on the site.

Docker and the Docker logo are trademarks or registered trademarks of Docker, Inc. in the United States and/or other countries. Docker, Inc. and other parties may also have trademark rights in other terms used herein

  • No labels