firebirdテクテクテクブログ

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

# .wslconfig ファイルの推奨設定（%USERPROFILE%\.wslconfig）
[wsl2]
memory=8GB
processors=4
localhostForwarding=true
vmIdleTimeout=60000

# swap を無効化（開発環境のみ）
swap=0
swapFile=

# 実験的機能の有効化
[experimental]
sparseVhd=true
autoMemoryReclaim=dropcache

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

{
  "builder": {
    "gc": {
      "enabled": true,
      "defaultKeepStorage": "20GB"
    }
  },
  "experimental": true,
  "features": {
    "buildkit": true
  },
  "resourcesSettings": {
    "cpus": 4,
    "memory": 8192,
    "disk": {
      "size": 100
    }
  }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

# マルチステージビルドによる最適化
FROM node:18-alpine AS deps
WORKDIR /app
# 依存関係のみ先にコピー（キャッシュ効率化）
COPY package*.json ./
RUN npm ci --only=production && npm cache clean --force

FROM node:18-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

FROM node:18-alpine AS runner
WORKDIR /app
ENV NODE_ENV production

# 必要最小限のファイルのみコピー
COPY --from=deps /app/node_modules ./node_modules
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/public ./public

# セキュリティ強化
RUN addgroup --system --gid 1001 nodejs
RUN adduser --system --uid 1001 nextjs
USER nextjs

EXPOSE 3000
CMD ["npm", "start"]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

# docker-compose.dev.yml
version: '3.8'
services:
  app:
    build:
      context: .
      target: development
    volumes:
      # バインドマウント最適化
      - .:/app:cached
      - /app/node_modules
      # 名前付きボリュームでキャッシュ
      - node_modules_cache:/app/node_modules
    environment:
      - CHOKIDAR_USEPOLLING=false
      - WATCHPACK_POLLING=false

volumes:
  node_modules_cache:
    driver: local

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

#!/bin/bash
# Docker性能測定スクリプト

echo "=== Docker Build Performance Test ==="

# ビルド時間測定
time docker build --no-cache -t test-app .

# イメージサイズ確認
docker images test-app --format "table {{.Size}}\t{{.CreatedAt}}"

# コンテナリソース使用量
docker stats --no-stream

# レイヤーサイズ分析
docker history test-app --format "table {{.Size}}\t{{.CreatedBy}}"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90

# batch_job_monitor.py
import newrelic.agent
import time
import logging
from datetime import datetime

class BatchJobMonitor:
    def __init__(self):
        # New Relic 初期化
        newrelic.agent.initialize('newrelic.ini')
        self.logger = logging.getLogger(__name__)
    
    @newrelic.agent.background_task(name='batch-data-processing')
    def process_data_batch(self, batch_id, data_source):
        """データ処理バッチジョブ"""
        
        # カスタムメトリクス記録開始
        start_time = time.time()
        
        try:
            # カスタム属性設定
            newrelic.agent.add_custom_attribute('batch_id', batch_id)
            newrelic.agent.add_custom_attribute('data_source', data_source)
            newrelic.agent.add_custom_attribute('job_type', 'data_processing')
            
            # 処理実行
            result = self._execute_processing(data_source)
            
            # 成功メトリクス記録
            newrelic.agent.record_custom_metric('Custom/BatchJob/ProcessedRecords', result['processed_count'])
            newrelic.agent.record_custom_metric('Custom/BatchJob/SuccessRate', result['success_rate'])
            
            return result
            
        except Exception as e:
            # エラー詳細記録
            newrelic.agent.record_exception()
            newrelic.agent.add_custom_attribute('error_type', type(e).__name__)
            newrelic.agent.add_custom_attribute('error_message', str(e))
            
            raise
        
        finally:
            # 実行時間記録
            execution_time = time.time() - start_time
            newrelic.agent.record_custom_metric('Custom/BatchJob/ExecutionTime', execution_time)
    
    def _execute_processing(self, data_source):
        """実際のデータ処理ロジック"""
        
        # データベース操作の監視
        with newrelic.agent.DatabaseTrace('PostgreSQL', 'SELECT', 'batch_data'):
            raw_data = self.fetch_batch_data(data_source)
        
        # 外部API呼び出しの監視
        with newrelic.agent.ExternalTrace('external_service', 'http://api.example.com'):
            enriched_data = self.enrich_data(raw_data)
        
        # 処理結果の返却
        return {
            'processed_count': len(enriched_data),
            'success_rate': 0.95,
            'batch_size': len(raw_data)
        }

# Docker化されたバッチジョブ
class DockerizedBatchRunner:
    def __init__(self):
        self.monitor = BatchJobMonitor()
    
    def run_containerized_job(self, job_config):
        """コンテナ化されたジョブの実行"""
        
        container_id = None
        try:
            # コンテナ起動と監視
            container_id = self.start_monitored_container(job_config)
            
            # ジョブ実行状況をリアルタイム監視
            self.monitor_container_execution(container_id)
            
            # 結果収集
            result = self.collect_job_results(container_id)
            
            return result
            
        finally:
            # コンテナクリーンアップ
            if container_id:
                self.cleanup_container(container_id)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

FROM python:3.11-slim

# New Relic エージェントインストール
RUN pip install newrelic

# 設定ファイルコピー
COPY newrelic.ini /app/
COPY batch_job_monitor.py /app/

WORKDIR /app

# 環境変数設定
ENV NEW_RELIC_CONFIG_FILE=/app/newrelic.ini
ENV NEW_RELIC_ENVIRONMENT=production

# バッチジョブ実行
CMD ["newrelic-admin", "run-program", "python", "batch_job.py"]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

# k8s-batch-job.yaml
apiVersion: batch/v1
kind: Job
metadata:
  name: monitored-batch-job
  labels:
    app: batch-processor
    monitoring: newrelic
spec:
  template:
    metadata:
      annotations:
        newrelic.com/scrape: "true"
    spec:
      containers:
      - name: batch-processor
        image: batch-app:latest
        env:
        - name: NEW_RELIC_LICENSE_KEY
          valueFrom:
            secretKeyRef:
              name: newrelic-secret
              key: license-key
        - name: NEW_RELIC_APP_NAME
          value: "Batch-Job-Processor"
        resources:
          requests:
            memory: "256Mi"
            cpu: "250m"
          limits:
            memory: "512Mi"
            cpu: "500m"
      restartPolicy: Never
  backoffLimit: 3

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

# カスタムダッシュボード設定
dashboard_config = {
    "dashboard": {
        "title": "Docker Batch Jobs Monitoring",
        "widgets": [
            {
                "title": "Batch Job Execution Time",
                "nrql": "SELECT average(Custom/BatchJob/ExecutionTime) FROM Metric FACET batch_id TIMESERIES"
            },
            {
                "title": "Success Rate",
                "nrql": "SELECT average(Custom/BatchJob/SuccessRate) FROM Metric TIMESERIES"
            },
            {
                "title": "Error Rate by Type",
                "nrql": "SELECT count(*) FROM TransactionError FACET error.class TIMESERIES"
            },
            {
                "title": "Container Resource Usage",
                "nrql": "SELECT average(container.cpuPercent), average(container.memoryUsageBytes) FROM Metric TIMESERIES"
            }
        ]
    }
}

# アラート設定
alert_conditions = [
    {
        "name": "Batch Job Failure Rate High",
        "condition": "SELECT percentage(count(*), WHERE error IS true) FROM Transaction WHERE appName = 'Batch-Job-Processor'",
        "threshold": 10,  # 10%以上の失敗率でアラート
        "duration": 300   # 5分間
    },
    {
        "name": "Batch Job Execution Time Anomaly",
        "condition": "SELECT average(duration) FROM Transaction WHERE transactionType = 'Other'",
        "threshold": 600, # 10分以上でアラート
        "duration": 60
    }
]

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117

# nginx.conf - 本番環境最適化版
user nginx;
worker_processes auto;
worker_rlimit_nofile 65535;

events {
    worker_connections 4096;
    use epoll;
    multi_accept on;
}

http {
    # 基本設定
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    keepalive_requests 1000;
    
    # パフォーマンス最適化
    open_file_cache max=10000 inactive=20s;
    open_file_cache_valid 30s;
    open_file_cache_min_uses 2;
    open_file_cache_errors on;
    
    # 圧縮設定
    gzip on;
    gzip_vary on;
    gzip_min_length 1000;
    gzip_types
        application/javascript
        application/json
        application/xml
        text/css
        text/plain
        text/xml;
    
    # セキュリティヘッダー
    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
    
    # ログ設定
    log_format json_combined escape=json
        '{'
        '"time_local":"$time_local",'
        '"remote_addr":"$remote_addr",'
        '"remote_user":"$remote_user",'
        '"request":"$request",'
        '"status": "$status",'
        '"body_bytes_sent":"$body_bytes_sent",'
        '"request_time":"$request_time",'
        '"http_referrer":"$http_referer",'
        '"http_user_agent":"$http_user_agent"'
        '}';
    
    access_log /var/log/nginx/access.log json_combined;
    error_log /var/log/nginx/error.log warn;
    
    # アップストリーム設定
    upstream app_backend {
        server app1:3000 max_fails=3 fail_timeout=30s;
        server app2:3000 max_fails=3 fail_timeout=30s;
        keepalive 32;
    }
    
    server {
        listen 80;
        server_name _;
        return 301 https://$server_name$request_uri;
    }
    
    server {
        listen 443 ssl http2;
        server_name example.com;
        
        # SSL設定
        ssl_certificate /etc/ssl/certs/server.crt;
        ssl_certificate_key /etc/ssl/private/server.key;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512;
        ssl_prefer_server_ciphers off;
        
        # 静的ファイル配信
        location /static/ {
            alias /var/www/static/;
            expires 1y;
            add_header Cache-Control "public, immutable";
        }
        
        # アプリケーションプロキシ
        location / {
            proxy_pass http://app_backend;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection 'upgrade';
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_cache_bypass $http_upgrade;
            
            # タイムアウト設定
            proxy_connect_timeout 5s;
            proxy_send_timeout 60s;
            proxy_read_timeout 60s;
        }
        
        # ヘルスチェック用エンドポイント
        location /health {
            access_log off;
            return 200 "healthy\n";
            add_header Content-Type text/plain;
        }
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

# Nginx + アプリケーション統合Dockerfile
FROM node:18-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

FROM nginx:alpine AS production

# カスタムNginx設定
COPY nginx.conf /etc/nginx/nginx.conf
COPY ssl/ /etc/ssl/

# ビルド成果物コピー
COPY --from=builder /app/dist /var/www/html
COPY --from=builder /app/static /var/www/static

# ログディレクトリ作成
RUN mkdir -p /var/log/nginx

# ヘルスチェック
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
    CMD curl -f http://localhost/health || exit 1

EXPOSE 80 443

CMD ["nginx", "-g", "daemon off;"]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63

# docker-compose.yml - Nginx + アプリケーション
version: '3.8'

services:
  nginx:
    build:
      context: .
      dockerfile: Dockerfile.nginx
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./ssl:/etc/ssl/certs:ro
      - nginx_logs:/var/log/nginx
    depends_on:
      - app1
      - app2
    networks:
      - app_network
    deploy:
      resources:
        limits:
          memory: 256M
          cpus: '0.5'

  app1:
    build: .
    environment:
      - NODE_ENV=production
      - PORT=3000
    networks:
      - app_network
    deploy:
      replicas: 2
      resources:
        limits:
          memory: 512M
          cpus: '1.0'

  app2:
    build: .
    environment:
      - NODE_ENV=production
      - PORT=3000
    networks:
      - app_network
    deploy:
      replicas: 2

  log_aggregator:
    image: fluent/fluentd:latest
    volumes:
      - nginx_logs:/var/log/nginx:ro
      - ./fluentd.conf:/fluentd/etc/fluent.conf
    networks:
      - app_network

volumes:
  nginx_logs:

networks:
  app_network:
    driver: bridge

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62

# CloudFormation テンプレート
AWSTemplateFormatVersion: '2010-09-09'
Description: 'Secure ECS cluster in private VPC'

Resources:
  # VPC設定
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsHostnames: true
      EnableDnsSupport: true
      
  # プライベートサブネット
  PrivateSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.1.0/24
      AvailabilityZone: !Select [0, !GetAZs '']
      
  PrivateSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.2.0/24
      AvailabilityZone: !Select [1, !GetAZs '']
  
  # VPCエンドポイント（ECR用）
  ECREndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref VPC
      ServiceName: !Sub 'com.amazonaws.${AWS::Region}.ecr.dkr'
      VpcEndpointType: Interface
      SubnetIds:
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2
        
  ECRAPIEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref VPC
      ServiceName: !Sub 'com.amazonaws.${AWS::Region}.ecr.api'
      VpcEndpointType: Interface
      
  # S3エンドポイント
  S3Endpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref VPC
      ServiceName: !Sub 'com.amazonaws.${AWS::Region}.s3'
      VpcEndpointType: Gateway

  # ECSクラスター
  ECSCluster:
    Type: AWS::ECS::Cluster
    Properties:
      ClusterName: secure-private-cluster
      ClusterSettings:
        - Name: containerInsights
          Value: enabled

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68

{
  "family": "secure-app",
  "networkMode": "awsvpc",
  "requiresCompatibilities": ["FARGATE"],
  "cpu": "512",
  "memory": "1024",
  "executionRoleArn": "arn:aws:iam::ACCOUNT:role/ecsTaskExecutionRole",
  "taskRoleArn": "arn:aws:iam::ACCOUNT:role/ecsTaskRole",
  "containerDefinitions": [
    {
      "name": "nginx",
      "image": "your-account.dkr.ecr.region.amazonaws.com/nginx:latest",
      "portMappings": [
        {
          "containerPort": 80,
          "protocol": "tcp"
        }
      ],
      "essential": true,
      "logConfiguration": {
        "logDriver": "awslogs",
        "options": {
          "awslogs-group": "/ecs/secure-app",
          "awslogs-region": "us-east-1",
          "awslogs-stream-prefix": "nginx"
        }
      },
      "healthCheck": {
        "command": ["CMD-SHELL", "curl -f http://localhost/health || exit 1"],
        "interval": 30,
        "timeout": 5,
        "retries": 3,
        "startPeriod": 60
      }
    },
    {
      "name": "app",
      "image": "your-account.dkr.ecr.region.amazonaws.com/app:latest",
      "portMappings": [
        {
          "containerPort": 3000,
          "protocol": "tcp"
        }
      ],
      "essential": true,
      "environment": [
        {
          "name": "NODE_ENV",
          "value": "production"
        }
      ],
      "secrets": [
        {
          "name": "DATABASE_URL",
          "valueFrom": "arn:aws:secretsmanager:region:account:secret:database-url"
        }
      ],
      "logConfiguration": {
        "logDriver": "awslogs",
        "options": {
          "awslogs-group": "/ecs/secure-app",
          "awslogs-region": "us-east-1",
          "awslogs-stream-prefix": "app"
        }
      }
    }
  ]
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97

# main.tf
provider "aws" {
  region = var.aws_region
}

# ECSクラスター
resource "aws_ecs_cluster" "main" {
  name = "secure-cluster"

  setting {
    name  = "containerInsights"
    value = "enabled"
  }

  tags = {
    Environment = var.environment
    Project     = var.project_name
  }
}

# ECSサービス
resource "aws_ecs_service" "app" {
  name            = "secure-app-service"
  cluster         = aws_ecs_cluster.main.id
  task_definition = aws_ecs_task_definition.app.arn
  desired_count   = var.desired_count
  launch_type     = "FARGATE"

  network_configuration {
    subnets          = var.private_subnet_ids
    security_groups  = [aws_security_group.ecs_tasks.id]
    assign_public_ip = false
  }

  load_balancer {
    target_group_arn = aws_lb_target_group.app.arn
    container_name   = "nginx"
    container_port   = 80
  }

  deployment_configuration {
    maximum_percent         = 200
    minimum_healthy_percent = 50
  }

  depends_on = [aws_lb_listener.app]
}

# セキュリティグループ
resource "aws_security_group" "ecs_tasks" {
  name        = "ecs-tasks-sg"
  description = "Allow inbound access for ECS tasks"
  vpc_id      = var.vpc_id

  ingress {
    protocol        = "tcp"
    from_port       = 80
    to_port         = 80
    security_groups = [aws_security_group.alb.id]
  }

  egress {
    protocol    = "-1"
    from_port   = 0
    to_port     = 0
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "ecs-tasks-sg"
  }
}

# Auto Scaling設定
resource "aws_appautoscaling_target" "ecs_target" {
  max_capacity       = 10
  min_capacity       = 2
  resource_id        = "service/${aws_ecs_cluster.main.name}/${aws_ecs_service.app.name}"
  scalable_dimension = "ecs:service:DesiredCount"
  service_namespace  = "ecs"
}

resource "aws_appautoscaling_policy" "scale_up" {
  name               = "scale-up"
  policy_type        = "TargetTrackingScaling"
  resource_id        = aws_appautoscaling_target.ecs_target.resource_id
  scalable_dimension = aws_appautoscaling_target.ecs_target.scalable_dimension
  service_namespace  = aws_appautoscaling_target.ecs_target.service_namespace

  target_tracking_scaling_policy_configuration {
    target_value = 70.0

    predefined_metric_specification {
      predefined_metric_type = "ECSServiceAverageCPUUtilization"
    }
  }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

# セキュアなDockerfile例
FROM node:18-alpine AS base

# セキュリティ強化
RUN apk --no-cache add dumb-init \
    && addgroup -g 1001 -S nodejs \
    && adduser -S nextjs -u 1001 -G nodejs

# 脆弱性スキャン対応
RUN apk update && apk upgrade

FROM base AS deps
WORKDIR /app
USER nextjs

# 依存関係のセキュリティ監査
COPY --chown=nextjs:nodejs package*.json ./
RUN npm audit --audit-level moderate \
    && npm ci --only=production

FROM base AS runner
WORKDIR /app
USER nextjs

# 最小権限でファイルコピー
COPY --from=deps --chown=nextjs:nodejs /app/node_modules ./node_modules
COPY --chown=nextjs:nodejs . .

# セキュリティヘッダー設定
EXPOSE 3000
ENV PORT 3000

# dumb-init使用でPID 1問題回避
ENTRYPOINT ["dumb-init", "--"]
CMD ["npm", "start"]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67

# セキュリティ監視コンテナ
import docker
import psutil
import logging
from datetime import datetime

class ContainerSecurityMonitor:
    def __init__(self):
        self.client = docker.from_env()
        self.logger = logging.getLogger(__name__)
        
    def monitor_container_behavior(self, container_id):
        """コンテナの異常動作監視"""
        
        try:
            container = self.client.containers.get(container_id)
            
            # リソース使用量監視
            stats = container.stats(stream=False)
            cpu_usage = self.calculate_cpu_percentage(stats)
            memory_usage = stats['memory_stats']['usage']
            
            # 異常検知
            if cpu_usage > 80:
                self.alert_high_cpu_usage(container_id, cpu_usage)
            
            if memory_usage > 1024 * 1024 * 1024:  # 1GB
                self.alert_high_memory_usage(container_id, memory_usage)
            
            # ネットワーク通信監視
            network_stats = stats['networks']
            self.monitor_network_traffic(container_id, network_stats)
            
            # プロセス監視
            processes = container.top()
            self.monitor_processes(container_id, processes)
            
        except docker.errors.NotFound:
            self.logger.warning(f"Container {container_id} not found")
        except Exception as e:
            self.logger.error(f"Monitoring error: {e}")
    
    def monitor_network_traffic(self, container_id, network_stats):
        """ネットワーク通信の異常検知"""
        
        for interface, stats in network_stats.items():
            rx_bytes = stats['rx_bytes']
            tx_bytes = stats['tx_bytes']
            
            # 大量データ転送の検知
            if rx_bytes > 100 * 1024 * 1024:  # 100MB
                self.alert_suspicious_network_activity(
                    container_id, interface, 'high_inbound', rx_bytes
                )
    
    def alert_high_cpu_usage(self, container_id, cpu_usage):
        """CPU使用率アラート"""
        alert_data = {
            'timestamp': datetime.now().isoformat(),
            'container_id': container_id,
            'alert_type': 'high_cpu_usage',
            'cpu_percentage': cpu_usage,
            'severity': 'warning'
        }
        
        # 監視システムに送信
        self.send_alert(alert_data)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

# network-policy.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: secure-app-policy
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: secure-app
  policyTypes:
  - Ingress
  - Egress
  
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: ingress-nginx
    ports:
    - protocol: TCP
      port: 80
  
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          name: database
    ports:
    - protocol: TCP
      port: 5432
  - to: []
    ports:
    - protocol: TCP
      port: 443  # HTTPS only