From 4f92b3aa7023fa2ddb2b87398b1eaf0fd8b8faf0 Mon Sep 17 00:00:00 2001 From: yeasy Date: Wed, 20 May 2026 00:18:37 -0700 Subject: [PATCH] fix(19.3): add security trade-off note for cAdvisor privileged: true The cAdvisor compose examples in 19.3.3 use `privileged: true`, which contradicts the minimum-privilege / cap_drop=all guidance in chapter 18. Add an explicit trade-off note before the first cAdvisor snippet explaining the inconsistency and pointing to 18.4 for capability-based hardening alternatives (cap_add: [SYS_ADMIN] + device_cgroup_rules instead of full privileged mode). This addresses the Round 1 review finding about pedagogical conflict between the monitoring and security chapters. --- 19_observability/19.3_performance_optimization.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/19_observability/19.3_performance_optimization.md b/19_observability/19.3_performance_optimization.md index 59a2716..bf99c01 100644 --- a/19_observability/19.3_performance_optimization.md +++ b/19_observability/19.3_performance_optimization.md @@ -100,6 +100,8 @@ done cAdvisor 是 Google 开发的容器监控工具，提供比 `docker stats` 更详细的性能数据。 +> **⚠️ 安全权衡提示**：下面的示例为简化部署使用了 `privileged: true`，与 [第 18 章](../18_security/README.md) 中"最小权限 / `cap_drop=all`"的原则相冲突。生产环境建议改为按需授予能力（如 `cap_add: [SYS_ADMIN]` 加 `device_cgroup_rules` 与精确的 `devices`、`volumes` 挂载），并将 cAdvisor 部署在独立的监控网络中。如何选择请参考 [18.4 节](../18_security/18.4_kernel_capability.md) 关于内核能力（capabilities）的细化授权。 + **Docker Compose 部署 cAdvisor：** ```yaml