Retrospective: Implementing Zero-Trust Security for Docker 28 Containers – 1 Year of Trivy 0.55 and Vault 1.18

# .github/workflows/container-security.yml
# CI pipeline for Docker 28 image builds with Trivy 0.55 scanning, SBOM generation, and signing
# Requires: Trivy 0.55.0, Docker 28.0.0, Cosign 2.2.0, GitHub OIDC for Vault auth
name: Container Security Pipeline
on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  TRIVY_VERSION: 0.55.0
  DOCKER_VERSION: 28.0.1
  VAULT_ADDR: https://vault.example.com:8200

jobs:
  build-scan-sign:
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: write
      id-token: write # Required for OIDC auth to Vault

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Required for SBOM git metadata

      - name: Log in to Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker 28.0.1
        uses: docker/setup-docker-action@v3
        with:
          version: ${{ env.DOCKER_VERSION }}
          daemon-args: --experimental # Enable Docker 28 experimental features for SBOM

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=sha,format=long
            type=ref,event=branch
            type=semver,pattern={{version}}

      - name: Build Docker 28 image with native SBOM generation
        id: build
        uses: docker/build-push-action@v5
        with:
          context: .
          push: false
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          # Docker 28 native SBOM generation via --sbom flag
          build-args: |
            SBOM_ENABLED=true
          outputs: type=docker,dest=/tmp/image.tar

      - name: Install Trivy 0.55.0
        run: |
          wget https://github.com/aquasecurity/trivy/releases/download/v${{ env.TRIVY_VERSION }}/trivy_${{ env.TRIVY_VERSION }}_Linux-64bit.deb
          sudo dpkg -i trivy_${{ env.TRIVY_VERSION }}_Linux-64bit.deb
          trivy --version # Verify install, exit if fails
          if [ $? -ne 0 ]; then
            echo "Trivy install failed"
            exit 1
          fi

      - name: Scan image with Trivy 0.55 for high/critical CVEs
        id: trivy-scan
        run: |
          trivy image --exit-code 1 --severity HIGH,CRITICAL --format json --output trivy-report.json /tmp/image.tar
          # Capture exit code to handle scan failures
          SCAN_EXIT=$?
          if [ $SCAN_EXIT -eq 1 ]; then
            echo "High/critical CVEs found in image"
            cat trivy-report.json
            exit 1
          elif [ $SCAN_EXIT -ne 0 ]; then
            echo "Trivy scan failed with exit code $SCAN_EXIT"
            exit $SCAN_EXIT
          fi

      - name: Generate CycloneDX SBOM with Trivy 0.55
        run: |
          trivy sbom --format cyclonedx --output sbom.json /tmp/image.tar
          # Validate SBOM is non-empty
          if [ ! -s sbom.json ]; then
            echo "SBOM generation failed: empty file"
            exit 1
          fi

      - name: Authenticate to Vault 1.18 via OIDC
        id: vault-auth
        run: |
          # Install Vault 1.18 CLI
          wget https://github.com/hashicorp/vault/releases/download/v1.18.0/vault_1.18.0_linux_amd64.zip
          unzip vault_1.18.0_linux_amd64.zip
          sudo mv vault /usr/local/bin/
          vault version
          # Authenticate via GitHub OIDC
          vault login -method=oidc role=github-actions -token-only > vault-token.txt
          if [ $? -ne 0 ]; then
            echo "Vault authentication failed"
            exit 1
          fi

      - name: Sign SBOM and image with Cosign using Vault-stored key
        run: |
          # Retrieve Cosign private key from Vault 1.18 KMS
          vault kv get -field=cosign-private-key secret/container-signing > cosign.key
          chmod 600 cosign.key
          # Sign image
          cosign sign --key cosign.key ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}
          # Sign SBOM
          cosign sign --key cosign.key sbom.json
          # Verify signatures
          cosign verify --key cosign.key ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}
          if [ $? -ne 0 ]; then
            echo "Signature verification failed"
            exit 1
          fi

      - name: Push signed image to registry
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

      - name: Upload scan reports
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: security-reports
          path: |
            trivy-report.json
            sbom.json

// vault-secret-injector.go
// Go program to retrieve secrets from Vault 1.18 for Docker 28 containers
// Uses Docker 28's --secret flag to mount Vault token, no hardcoded credentials
// Requires: Vault 1.18.0, Go 1.22, Docker 28.0.1
package main

import (
    "encoding/json"
    "fmt"
    "io"
    "net/http"
    "os"
    "time"
)

// SecretConfig defines the structure of secrets retrieved from Vault
type SecretConfig struct {
    DBHost     string `json:"db_host"`
    DBPort     string `json:"db_port"`
    DBUser     string `json:"db_user"`
    DBPassword string `json:"db_password"`
    APIKey     string `json:"api_key"`
}

func main() {
    // Read Vault token from Docker 28 mounted secret (--secret id=vault-token,src=/run/secrets/vault-token)
    vaultTokenPath := "/run/secrets/vault-token"
    tokenBytes, err := os.ReadFile(vaultTokenPath)
    if err != nil {
        fmt.Printf("FATAL: Failed to read Vault token from %s: %v\n", vaultTokenPath, err)
        os.Exit(1)
    }
    vaultToken := string(tokenBytes)
    if vaultToken == "" {
        fmt.Println("FATAL: Vault token is empty")
        os.Exit(1)
    }

    // Read Vault address from environment (set via Docker 28 --env flag, not hardcoded)
    vaultAddr := os.Getenv("VAULT_ADDR")
    if vaultAddr == "" {
        fmt.Println("FATAL: VAULT_ADDR environment variable not set")
        os.Exit(1)
    }

    // Retrieve secrets from Vault 1.18 KV v2 endpoint
    secretPath := "secret/data/prod/app-config"
    url := fmt.Sprintf("%s/v1/%s", vaultAddr, secretPath)
    req, err := http.NewRequest("GET", url, nil)
    if err != nil {
        fmt.Printf("FATAL: Failed to create Vault request: %v\n", err)
        os.Exit(1)
    }
    req.Header.Set("X-Vault-Token", vaultToken)
    req.Header.Set("Content-Type", "application/json")

    client := &http.Client{Timeout: 5 * time.Second}
    resp, err := client.Do(req)
    if err != nil {
        fmt.Printf("FATAL: Failed to connect to Vault: %v\n", err)
        os.Exit(1)
    }
    defer resp.Body.Close()

    if resp.StatusCode != http.StatusOK {
        body, _ := io.ReadAll(resp.Body)
        fmt.Printf("FATAL: Vault returned non-200 status: %d, body: %s\n", resp.StatusCode, string(body))
        os.Exit(1)
    }

    // Parse Vault response
    body, err := io.ReadAll(resp.Body)
    if err != nil {
        fmt.Printf("FATAL: Failed to read Vault response: %v\n", err)
        os.Exit(1)
    }

    var vaultResp struct {
        Data struct {
            Data SecretConfig `json:"data"`
        } `json:"data"`
    }
    if err := json.Unmarshal(body, &vaultResp); err != nil {
        fmt.Printf("FATAL: Failed to parse Vault response: %v\n", err)
        os.Exit(1)
    }

    secrets := vaultResp.Data.Data
    // Validate required secrets are present
    if secrets.DBHost == "" || secrets.DBPassword == "" || secrets.APIKey == "" {
        fmt.Println("FATAL: Missing required secrets from Vault")
        os.Exit(1)
    }

    // Inject secrets into application environment (no hardcoded values)
    os.Setenv("DB_HOST", secrets.DBHost)
    os.Setenv("DB_PORT", secrets.DBPort)
    os.Setenv("DB_USER", secrets.DBUser)
    os.Setenv("DB_PASSWORD", secrets.DBPassword)
    os.Setenv("API_KEY", secrets.APIKey)

    fmt.Println("INFO: Successfully injected secrets from Vault 1.18")
    // Start application (example: start HTTP server)
    startApp()
}

// startApp initializes the application with injected secrets
func startApp() {
    // In production, this would start your actual application
    fmt.Println("INFO: Starting application with Vault-injected secrets...")
    // Simulate application running
    select {}
}

## runtime-zero-trust-validator.py
## Python script to enforce zero-trust policies on Docker 28 containers at runtime
## Validates: SBOM signatures, Trivy scan results, Vault secret injection, non-root user
## Requires: Docker 28.0.1, Trivy 0.55.0, Vault 1.18.0, Python 3.12

import docker
import json
import os
import subprocess
import sys
from pathlib import Path

# Configuration
TRIVY_PATH = "/usr/local/bin/trivy"
VAULT_ADDR = os.getenv("VAULT_ADDR", "https://vault.example.com:8200")
SBOM_SIGNATURE_ANNOTATION = "org.opencontainers.image.sbom.signature"
MIN_TRIVY_VERSION = "0.55.0"

class ZeroTrustValidationError(Exception):
    """Custom exception for zero-trust validation failures"""
    pass

def check_trivy_version():
    """Verify Trivy version meets minimum requirement"""
    try:
        result = subprocess.run([TRIVY_PATH, "--version"], capture_output=True, text=True)
        if result.returncode != 0:
            raise ZeroTrustValidationError(f"Trivy not found at {TRIVY_PATH}")
        version = result.stdout.split()[1].lstrip("v")
        if version < MIN_TRIVY_VERSION:
            raise ZeroTrustValidationError(f"Trivy version {version} < minimum {MIN_TRIVY_VERSION}")
    except Exception as e:
        raise ZeroTrustValidationError(f"Trivy version check failed: {e}")

def validate_container(container_id):
    """Run all zero-trust checks on a running Docker 28 container"""
    client = docker.from_env()
    try:
        container = client.containers.get(container_id)
    except Exception as e:
        raise ZeroTrustValidationError(f"Failed to get container {container_id}: {e}")

    print(f"Validating container {container_id} ({container.image.tags[0] if container.image.tags else 'untagged'})")

    # Check 1: Container runs as non-root
    inspect = container.attrs
    user = inspect.get("Config", {}).get("User", "")
    if user == "" or user == "0" or user == "root":
        raise ZeroTrustValidationError("Container runs as root user")
    print("✅ Check 1: Non-root user")

    # Check 2: SBOM signature exists in image annotations
    image = container.image
    annotations = image.attrs.get("Config", {}).get("Labels", {})
    sbom_sig = annotations.get(SBOM_SIGNATURE_ANNOTATION, "")
    if not sbom_sig:
        raise ZeroTrustValidationError("No SBOM signature found in image labels")
    print("✅ Check 2: SBOM signature present")

    # Check 3: Trivy 0.55 scan passed (no high/critical CVEs)
    # Export image to tar for Trivy scanning
    image_tar = f"/tmp/{container_id}_image.tar"
    with open(image_tar, "wb") as f:
        for chunk in image.save():
            f.write(chunk)
    # Run Trivy scan
    try:
        result = subprocess.run(
            [TRIVY_PATH, "image", "--severity", "HIGH,CRITICAL", "--exit-code", "1", image_tar],
            capture_output=True, text=True
        )
        if result.returncode == 1:
            raise ZeroTrustValidationError(f"Trivy found high/critical CVEs: {result.stdout}")
        elif result.returncode != 0:
            raise ZeroTrustValidationError(f"Trivy scan failed: {result.stderr}")
    finally:
        Path(image_tar).unlink(missing_ok=True)
    print("✅ Check 3: No high/critical CVEs (Trivy 0.55)")

    # Check 4: Vault secret is injected (Docker 28 secret mounted)
    secret_path = "/run/secrets/vault-token"
    exec_result = container.exec_run(f"test -f {secret_path}")
    if exec_result.exit_code != 0:
        raise ZeroTrustValidationError(f"Vault token secret not mounted at {secret_path}")
    # Verify Vault token is valid
    token_exec = container.exec_run(f"cat {secret_path}")
    vault_token = token_exec.output.decode().strip()
    if not vault_token:
        raise ZeroTrustValidationError("Vault token is empty")
    # Validate token against Vault 1.18
    vault_check = subprocess.run(
        ["vault", "token", "lookup", "-token", vault_token],
        capture_output=True, text=True
    )
    if vault_check.returncode != 0:
        raise ZeroTrustValidationError(f"Invalid Vault token: {vault_check.stderr}")
    print("✅ Check 4: Valid Vault secret injected")

    # Check 5: Image is signed with Cosign (verified against Vault-stored public key)
    image_ref = container.image.tags[0] if container.image.tags else container.image.id
    cosign_check = subprocess.run(
        ["cosign", "verify", "--key", "vault:secret/container-signing/cosign-public-key", image_ref],
        capture_output=True, text=True
    )
    if cosign_check.returncode != 0:
        raise ZeroTrustValidationError(f"Image signature verification failed: {cosign_check.stderr}")
    print("✅ Check 5: Image signature valid")

    print(f"✅ Container {container_id} passed all zero-trust checks")
    return True

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} ")
        sys.exit(1)
    try:
        check_trivy_version()
        validate_container(sys.argv[1])
    except ZeroTrustValidationError as e:
        print(f"❌ Validation failed: {e}")
        sys.exit(1)
    except Exception as e:
        print(f"❌ Unexpected error: {e}")
        sys.exit(1)

# Check for valid SBOM in CI
docker inspect --format '{{.Config.Labels.org.opencontainers.image.sbom}}' $IMAGE_ID | grep -q "cyclonedx" || exit 1

docker run --secret id=vault-token,src=/run/secrets/vault-token --env VAULT_ADDR=https://vault.example.com:8200 my-image:latest

trivy sbom --format cyclonedx --output sbom.json my-image:latest && trivy scan sbom.json --severity HIGH,CRITICAL