docs(content): harden Kubernetes and supply-chain examples

18_security/18.3_daemon_sec.md

@@ -68,9 +68,11 @@ $ sudo apt-get install uidmap
 $ su - testuser
 ```
 
-3. 运行 Docker 官方提供的 Rootless 安装脚本：
+3. 下载并检查 Docker 官方提供的 Rootless 安装脚本，确认来源和内容后再执行：
 ```bash
-$ curl -fsSL https://get.docker.com/rootless | sh
+$ curl -fsSL https://get.docker.com/rootless -o install-rootless-docker.sh
+$ less install-rootless-docker.sh
+$ sh install-rootless-docker.sh
 ```
 
 4. 配置环境变量指向新创建的私有 socket：

18_security/18.6_image_security.md

@@ -502,29 +502,29 @@ variables:
 
 build:
   stage: build
-  image: docker:latest
+  image: docker:<version>-cli@sha256:<docker-cli-digest>
   services:
-    - docker:dind
+    - name: docker:<version>-dind@sha256:<docker-dind-digest>
   script:
     - docker build -t $IMAGE_NAME:$CI_COMMIT_SHA .
     - docker save $IMAGE_NAME:$CI_COMMIT_SHA > image.tar
 
 scan:trivy:
   stage: scan
-  image: aquasec/trivy:latest
+  image: aquasec/trivy:<version>@sha256:<trivy-digest>
   script:
     - trivy image --severity HIGH,CRITICAL --exit-code 1 docker-archive://image.tar
   allow_failure: false
 
 scan:grype:
   stage: scan
-  image: anchore/grype:latest
+  image: anchore/grype:<version>@sha256:<grype-digest>
   script:
     - grype docker-archive://image.tar
 
 generate:sbom:
   stage: scan
-  image: anchore/syft:latest
+  image: anchore/syft:<version>@sha256:<syft-digest>
   script:
     - syft docker-archive://image.tar -o cyclonedx > sbom.xml
   artifacts:
@@ -533,9 +533,9 @@ generate:sbom:
 
 push:
   stage: push
-  image: docker:latest
+  image: docker:<version>-cli@sha256:<docker-cli-digest>
   services:
-    - docker:dind
+    - name: docker:<version>-dind@sha256:<docker-dind-digest>
   script:
     - docker load < image.tar
     - echo "$REGISTRY_PASSWORD" | docker login --username "$REGISTRY_USER" --password-stdin "$REGISTRY"
@@ -550,13 +550,11 @@ push:
 
 sign:
   stage: sign
-  image: gcr.io/projectsigstore/cosign:latest
+  image: gcr.io/projectsigstore/cosign:<version>@sha256:<cosign-digest>
   script:
     - cosign sign --key $COSIGN_KEY "$(cat image-digest.txt)"
   only:
     - main
-  only:
-    - main
 ```
 
 ### 18.6.6 常见问题与最佳实践