ehlxr/docker_practice
1
0
Fork 0
mirror of https://github.com/yeasy/docker_practice.git synced 2026-08-10 16:37:34 +00:00
Code Issues Projects Releases Wiki Activity

fix(19.3): add security trade-off note for cAdvisor privileged: true

Browse Source 
The cAdvisor compose examples in 19.3.3 use `privileged: true`, which
contradicts the minimum-privilege / cap_drop=all guidance in chapter 18.
Add an explicit trade-off note before the first cAdvisor snippet
explaining the inconsistency and pointing to 18.4 for capability-based
hardening alternatives (cap_add: [SYS_ADMIN] + device_cgroup_rules
instead of full privileged mode).

This addresses the Round 1 review finding about pedagogical conflict
between the monitoring and security chapters.
This commit is contained in:
yeasy
2026-05-20 00:18:37 -07:00
parent 58504e9316
commit 4f92b3aa70
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
19_observability/19.3_performance_optimization.md
+2
View File
@@ -100,6 +100,8 @@ done
cAdvisor 是 Google 开发的容器监控工具，提供比 `docker stats` 更详细的性能数据。 cAdvisor 是 Google 开发的容器监控工具，提供比 `docker stats` 更详细的性能数据。
> **⚠️ 安全权衡提示**：下面的示例为简化部署使用了 `privileged: true`，与 [第 18 章](../18_security/README.md) 中"最小权限 / `cap_drop=all`"的原则相冲突。生产环境建议改为按需授予能力（如 `cap_add: [SYS_ADMIN]` 加 `device_cgroup_rules` 与精确的 `devices`、`volumes` 挂载），并将 cAdvisor 部署在独立的监控网络中。如何选择请参考 [18.4 节](../18_security/18.4_kernel_capability.md) 关于内核能力（capabilities）的细化授权。
**Docker Compose 部署 cAdvisor：** **Docker Compose 部署 cAdvisor：**
```yaml ```yaml