{"id":788,"date":"2026-03-01T20:21:31","date_gmt":"2026-03-01T19:21:31","guid":{"rendered":"https:\/\/secure-pipelines.com\/uncategorized\/network-filesystem-restrictions-ci-cd-build-environments\/"},"modified":"2026-07-08T22:34:57","modified_gmt":"2026-07-08T21:34:57","slug":"network-filesystem-restrictions-ci-cd-build-environments","status":"publish","type":"post","link":"https:\/\/secure-pipelines.com\/ar\/ci-cd-security\/network-filesystem-restrictions-ci-cd-build-environments\/","title":{"rendered":"\u0642\u064a\u0648\u062f \u0627\u0644\u0634\u0628\u0643\u0629 \u0648\u0646\u0638\u0627\u0645 \u0627\u0644\u0645\u0644\u0641\u0627\u062a \u0644\u0628\u064a\u0626\u0627\u062a \u0628\u0646\u0627\u0621 CI\/CD"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">\u062a\u064f\u0639\u062f \u062e\u0637\u0648\u0637 \u0623\u0646\u0627\u0628\u064a\u0628 CI\/CD \u0645\u0646 \u0623\u0643\u062b\u0631 \u0627\u0644\u0623\u062d\u0645\u0627\u0644 \u0627\u0645\u062a\u064a\u0627\u0632\u0627\u064b \u0641\u064a \u0623\u064a \u0645\u0624\u0633\u0633\u0629. \u0641\u0647\u064a \u062a\u0633\u062d\u0628 \u0627\u0644\u0634\u064a\u0641\u0631\u0629 \u0627\u0644\u0645\u0635\u062f\u0631\u064a\u0629\u060c \u0648\u062a\u0646\u0632\u0651\u0644 \u0627\u0644\u062a\u0628\u0639\u064a\u0627\u062a\u060c \u0648\u062a\u0635\u0644 \u0625\u0644\u0649 \u0627\u0644\u0623\u0633\u0631\u0627\u0631\u060c \u0648\u062a\u062f\u0641\u0639 \u0627\u0644\u0640 artifacts \u0625\u0644\u0649 \u0633\u062c\u0644\u0627\u062a \u0627\u0644\u0625\u0646\u062a\u0627\u062c. \u0648\u0645\u0639 \u0630\u0644\u0643\u060c \u0641\u064a \u0643\u062b\u064a\u0631 \u0645\u0646 \u0627\u0644\u0628\u064a\u0626\u0627\u062a\u060c \u062a\u0639\u0645\u0644 \u0639\u0645\u0644\u064a\u0627\u062a \u0627\u0644\u0640 build \u0627\u0644\u0642\u0627\u0626\u0645\u0629 \u062e\u0644\u0641 \u0647\u0630\u0647 \u0627\u0644\u062e\u0637\u0648\u0637 \u0628\u0648\u0635\u0648\u0644 \u0634\u0628\u0643\u064a \u063a\u064a\u0631 \u0645\u0642\u064a\u0651\u062f \u0648\u0623\u0630\u0648\u0646\u0627\u062a \u0643\u0627\u0645\u0644\u0629 \u0639\u0644\u0649 \u0646\u0638\u0627\u0645 \u0627\u0644\u0645\u0644\u0641\u0627\u062a \u2014 \u0648\u0647\u0648 \u0645\u0632\u064a\u062c \u064a\u0645\u062b\u0651\u0644 \u0648\u0627\u062d\u062f\u0629 \u0645\u0646 \u0623\u0643\u062b\u0631 \u0627\u0644\u062b\u063a\u0631\u0627\u062a \u0642\u0627\u0628\u0644\u064a\u0629\u064b \u0644\u0644\u0627\u0633\u062a\u063a\u0644\u0627\u0644 \u0641\u064a \u062a\u0633\u0644\u064a\u0645 \u0627\u0644\u0628\u0631\u0645\u062c\u064a\u0627\u062a \u0627\u0644\u062d\u062f\u064a\u062b.<\/p>\n\n<p class=\"wp-block-paragraph\">\u0639\u0646\u062f\u0645\u0627 \u062a\u0633\u062a\u0637\u064a\u0639 \u0628\u064a\u0626\u0629 \u0627\u0644\u0640 build \u0627\u0644\u0648\u0635\u0648\u0644 \u0625\u0644\u0649 \u0623\u064a \u0639\u0646\u0648\u0627\u0646 IP \u0648\u0627\u0644\u0643\u062a\u0627\u0628\u0629 \u0641\u064a \u0623\u064a \u0645\u0633\u0627\u0631 \u0639\u0644\u0649 \u0627\u0644\u0642\u0631\u0635\u060c \u064a\u0645\u0643\u0646 \u0644\u062a\u0628\u0639\u064a\u0629 \u0648\u0627\u062d\u062f\u0629 \u0645\u062e\u062a\u0631\u064e\u0642\u0629 \u0623\u0648 \u0637\u0644\u0628 \u062f\u0645\u062c (pull request) \u062e\u0628\u064a\u062b \u0623\u0646 \u064a\u0633\u0631\u0651\u0628 \u0627\u0644\u0623\u0633\u0631\u0627\u0631\u060c \u0623\u0648 \u064a\u0639\u0628\u062b \u0628\u0627\u0644\u0640 artifacts\u060c \u0623\u0648 \u064a\u0646\u0634\u0626 \u0623\u0628\u0648\u0627\u0628\u0627\u064b \u062e\u0644\u0641\u064a\u0629 \u062f\u0627\u0626\u0645\u0629. \u064a\u063a\u0637\u0651\u064a \u0647\u0630\u0627 \u0627\u0644\u062f\u0644\u064a\u0644 \u062a\u0642\u0646\u064a\u0627\u062a \u0639\u0645\u0644\u064a\u0629 \u0644\u0625\u062d\u0643\u0627\u0645 \u0642\u064a\u0648\u062f \u0627\u0644\u0648\u0635\u0648\u0644 \u0627\u0644\u0634\u0628\u0643\u064a \u0648\u0627\u0644\u0648\u0635\u0648\u0644 \u0625\u0644\u0649 \u0646\u0638\u0627\u0645 \u0627\u0644\u0645\u0644\u0641\u0627\u062a \u0641\u064a \u0628\u064a\u0626\u0627\u062a build \u0627\u0644\u062e\u0627\u0635\u0629 \u0628\u0640 CI\/CD\u060c \u0645\u0646 NetworkPolicies \u0641\u064a Kubernetes \u0625\u0644\u0649 \u0623\u0646\u0638\u0645\u0629 \u0627\u0644\u0640 build \u0627\u0644\u0645\u064f\u062d\u0643\u064e\u0645\u0629 (hermetic).<\/p>\n\n<h2 class=\"wp-block-heading\">\u0644\u0645\u0627\u0630\u0627 \u062a\u064f\u0639\u062f \u0628\u064a\u0626\u0627\u062a \u0627\u0644\u0640 build \u063a\u064a\u0631 \u0627\u0644\u0645\u0642\u064a\u0651\u062f\u0629 \u062e\u0637\u064a\u0631\u0629<\/h2>\n\n<p class=\"wp-block-paragraph\">\u0642\u0628\u0644 \u0627\u0644\u062e\u0648\u0636 \u0641\u064a \u0627\u0644\u062d\u0644\u0648\u0644\u060c \u064a\u062c\u062f\u0631 \u0641\u0647\u0645 \u0627\u0644\u062a\u0647\u062f\u064a\u062f\u0627\u062a \u0627\u0644\u0645\u062d\u062f\u0651\u062f\u0629 \u0627\u0644\u062a\u064a \u062a\u062e\u0644\u0642\u0647\u0627 \u0628\u064a\u0626\u0627\u062a \u0627\u0644\u0640 build \u063a\u064a\u0631 \u0627\u0644\u0645\u0642\u064a\u0651\u062f\u0629. \u0648\u0647\u0630\u0647 \u0627\u0644\u0645\u062e\u0627\u0637\u0631 \u0644\u064a\u0633\u062a \u0646\u0638\u0631\u064a\u0629 \u2014 \u0641\u0642\u062f \u062c\u0631\u0649 \u0627\u0633\u062a\u063a\u0644\u0627\u0644\u0647\u0627 \u0641\u064a \u0647\u062c\u0645\u0627\u062a \u0633\u0644\u0633\u0644\u0629 \u062a\u0648\u0631\u064a\u062f \u0648\u0627\u0642\u0639\u064a\u0629.<\/p>\n\n<h3 class=\"wp-block-heading\">\u062a\u0633\u0631\u064a\u0628 \u0627\u0644\u0628\u064a\u0627\u0646\u0627\u062a<\/h3>\n\n<p class=\"wp-block-paragraph\">\u0643\u062b\u064a\u0631\u0627\u064b \u0645\u0627 \u062a\u0645\u0644\u0643 \u0628\u064a\u0626\u0627\u062a \u0627\u0644\u0640 build \u0648\u0635\u0648\u0644\u0627\u064b \u0625\u0644\u0649 \u0627\u0644\u0623\u0633\u0631\u0627\u0631: \u0645\u0641\u0627\u062a\u064a\u062d API\u060c \u0648\u0628\u064a\u0627\u0646\u0627\u062a \u0627\u0639\u062a\u0645\u0627\u062f \u0627\u0644\u0633\u062c\u0644\u0627\u062a\u060c \u0648\u0645\u0641\u0627\u062a\u064a\u062d \u0627\u0644\u062a\u0648\u0642\u064a\u0639\u060c \u0648\u0631\u0645\u0648\u0632 \u0627\u0644\u0646\u0634\u0631. \u0648\u0625\u0630\u0627 \u0643\u0627\u0646 \u0644\u0639\u0645\u0644\u064a\u0629 \u0627\u0644\u0640 build \u0648\u0635\u0648\u0644 \u0634\u0628\u0643\u064a \u0635\u0627\u062f\u0631 \u063a\u064a\u0631 \u0645\u0642\u064a\u0651\u062f\u060c \u0641\u064a\u0645\u0643\u0646 \u0644\u062a\u0628\u0639\u064a\u0629 \u0645\u062e\u062a\u0631\u064e\u0642\u0629 \u0623\u0646 \u062a\u0631\u0633\u0644 \u062a\u0644\u0643 \u0627\u0644\u0623\u0633\u0631\u0627\u0631 \u0625\u0644\u0649 \u062e\u0627\u062f\u0645 \u064a\u062a\u062d\u0643\u0645 \u0641\u064a\u0647 \u0627\u0644\u0645\u0647\u0627\u062c\u0645. \u0648\u0642\u062f \u064a\u062d\u062f\u062b \u0630\u0644\u0643 \u0639\u0628\u0631 \u0633\u0643\u0631\u0628\u062a <code>postinstall<\/code> \u062e\u0628\u064a\u062b \u0641\u064a \u062d\u0632\u0645\u0629 npm\u060c \u0623\u0648 \u062a\u0628\u0639\u064a\u0629 PyPI \u0645\u062e\u062a\u0631\u064e\u0642\u0629\u060c \u0623\u0648 \u062d\u062a\u0649 \u0647\u062f\u0641 Makefile \u0645\u064f\u0635\u0627\u063a \u0628\u0639\u0646\u0627\u064a\u0629. \u0641\u0628\u062f\u0648\u0646 \u0642\u064a\u0648\u062f \u0634\u0628\u0643\u064a\u0629\u060c \u0644\u0627 \u064a\u0648\u062c\u062f \u062d\u0627\u062c\u0632 \u0628\u064a\u0646 \u0627\u0644\u0633\u0631\u0651 \u0648\u0646\u0642\u0637\u0629 \u0646\u0647\u0627\u064a\u0629 \u0627\u0644\u0645\u0647\u0627\u062c\u0645.<\/p>\n\n<h3 class=\"wp-block-heading\">\u0647\u062c\u0645\u0627\u062a \u0633\u0644\u0633\u0644\u0629 \u0627\u0644\u062a\u0648\u0631\u064a\u062f<\/h3>\n\n<p class=\"wp-block-paragraph\">\u0627\u0644\u0645\u0647\u0627\u062c\u0645 \u0627\u0644\u0642\u0627\u062f\u0631 \u0639\u0644\u0649 \u062a\u0646\u0641\u064a\u0630 \u0634\u064a\u0641\u0631\u0629 \u0639\u0634\u0648\u0627\u0626\u064a\u0629 \u0623\u062b\u0646\u0627\u0621 \u0627\u0644\u0640 build \u064a\u0645\u0643\u0646\u0647 \u062a\u0639\u062f\u064a\u0644 artifacts \u0627\u0644\u0645\u062e\u0631\u062c\u0627\u062a. \u0641\u0625\u0630\u0627 \u0643\u0627\u0646 \u0646\u0638\u0627\u0645 \u0627\u0644\u0645\u0644\u0641\u0627\u062a \u0642\u0627\u0628\u0644\u0627\u064b \u0644\u0644\u0643\u062a\u0627\u0628\u0629 \u062f\u0648\u0646 \u0642\u064a\u0648\u062f\u060c \u0623\u0645\u0643\u0646 \u0627\u0644\u0639\u0628\u062b \u0628\u0627\u0644\u0645\u0644\u0641\u0627\u062a \u0627\u0644\u062b\u0646\u0627\u0626\u064a\u0629 \u0627\u0644\u0645\u064f\u0635\u0631\u064e\u0651\u0641\u0629\u060c \u0623\u0648 \u0635\u0648\u0631 \u0627\u0644\u062d\u0627\u0648\u064a\u0627\u062a\u060c \u0623\u0648 \u0628\u064a\u0627\u0646\u0627\u062a \u0627\u0644\u0646\u0634\u0631 (manifests)\u060c \u0628\u0639\u062f \u062e\u0637\u0648\u0629 \u0627\u0644\u0640 build \u0627\u0644\u0634\u0631\u0639\u064a\u0629 \u0644\u0643\u0646 \u0642\u0628\u0644 \u062f\u0641\u0639 \u0627\u0644\u0640 artifact. \u0648\u0647\u0630\u0627 \u062c\u0648\u0647\u0631 \u0643\u062b\u064a\u0631 \u0645\u0646 \u0647\u062c\u0645\u0627\u062a \u0633\u0644\u0633\u0644\u0629 \u0627\u0644\u062a\u0648\u0631\u064a\u062f \u2014 \u062a\u0628\u062f\u0648 \u0627\u0644\u0634\u064a\u0641\u0631\u0629 \u0627\u0644\u0645\u0635\u062f\u0631\u064a\u0629 \u0646\u0638\u064a\u0641\u0629\u060c \u0644\u0643\u0646 \u0627\u0644\u0640 artifact \u0627\u0644\u0645\u064f\u0633\u0644\u064e\u0651\u0645 \u0645\u0633\u0645\u0648\u0645.<\/p>\n\n<h3 class=\"wp-block-heading\">\u0627\u0644\u062d\u0631\u0643\u0629 \u0627\u0644\u062c\u0627\u0646\u0628\u064a\u0629<\/h3>\n\n<p class=\"wp-block-paragraph\">\u0628\u064a\u0626\u0627\u062a \u0627\u0644\u0640 build \u0627\u0644\u062a\u064a \u062a\u062a\u0634\u0627\u0631\u0643 \u0634\u0628\u0643\u0629 \u0645\u0639 \u0628\u0646\u064a\u0629 \u062a\u062d\u062a\u064a\u0629 \u0623\u062e\u0631\u0649 (\u0642\u0648\u0627\u0639\u062f \u0628\u064a\u0627\u0646\u0627\u062a\u060c \u0648\u0627\u062c\u0647\u0627\u062a \u0628\u0631\u0645\u062c\u0629 \u062a\u0637\u0628\u064a\u0642\u0627\u062a \u062f\u0627\u062e\u0644\u064a\u0629\u060c \u062e\u062f\u0645\u0627\u062a \u0628\u064a\u0627\u0646\u0627\u062a \u0648\u0635\u0641\u064a\u0629 \u0633\u062d\u0627\u0628\u064a\u0629) \u062a\u0645\u0646\u062d \u0627\u0644\u0645\u0647\u0627\u062c\u0645 \u0646\u0642\u0637\u0629 \u0627\u0631\u062a\u0643\u0627\u0632. \u0641\u064a\u0645\u0643\u0646 \u0644\u0645\u0647\u0645\u0629 build \u0645\u062e\u062a\u0631\u064e\u0642\u0629 \u0623\u0646 \u062a\u0645\u0633\u062d \u0627\u0644\u0634\u0628\u0643\u0627\u062a \u0627\u0644\u062f\u0627\u062e\u0644\u064a\u0629\u060c \u0648\u0623\u0646 \u062a\u0635\u0644 \u0625\u0644\u0649 \u0646\u0642\u0627\u0637 \u0646\u0647\u0627\u064a\u0629 \u0627\u0644\u0628\u064a\u0627\u0646\u0627\u062a \u0627\u0644\u0648\u0635\u0641\u064a\u0629 \u0644\u0646\u0633\u062e\u0629 \u0627\u0644\u0633\u062d\u0627\u0628\u0629 (\u0645\u062b\u0644 <code>169.254.169.254<\/code>)\u060c \u0648\u0623\u0646 \u062a\u062a\u0635\u0627\u0639\u062f \u0645\u0646 \u0633\u064a\u0627\u0642 CI\/CD \u0625\u0644\u0649 \u0648\u0635\u0648\u0644 \u0623\u0648\u0633\u0639 \u0644\u0644\u0628\u0646\u064a\u0629 \u0627\u0644\u062a\u062d\u062a\u064a\u0629.<\/p>\n\n<h2 class=\"wp-block-heading\">\u0627\u0644\u0642\u064a\u0648\u062f \u0627\u0644\u0634\u0628\u0643\u064a\u0629<\/h2>\n\n<p class=\"wp-block-paragraph\">\u0623\u0643\u062b\u0631 \u0636\u0627\u0628\u0637 \u064a\u0645\u0643\u0646\u0643 \u062a\u0637\u0628\u064a\u0642\u0647 \u062a\u0623\u062b\u064a\u0631\u0627\u064b \u0647\u0648 \u062a\u0642\u064a\u064a\u062f \u0627\u0644\u0648\u0635\u0648\u0644 \u0627\u0644\u0634\u0628\u0643\u064a \u0627\u0644\u0635\u0627\u062f\u0631 \u0645\u0646 \u0628\u064a\u0626\u0627\u062a \u0627\u0644\u0640 build. \u0641\u0639\u0645\u0644\u064a\u0627\u062a \u0627\u0644\u0640 build \u062a\u062d\u062a\u0627\u062c \u0625\u0644\u0649 \u0633\u062d\u0628 \u0627\u0644\u062a\u0628\u0639\u064a\u0627\u062a \u0648\u062f\u0641\u0639 \u0627\u0644\u0640 artifacts\u060c \u0644\u0643\u0646\u0647\u0627 \u0646\u0627\u062f\u0631\u0627\u064b \u0645\u0627 \u062a\u062d\u062a\u0627\u062c \u0625\u0644\u0649 \u0648\u0635\u0648\u0644 \u063a\u064a\u0631 \u0645\u0642\u064a\u0651\u062f \u0625\u0644\u0649 \u0627\u0644\u0625\u0646\u062a\u0631\u0646\u062a.<\/p>\n\n<h3 class=\"wp-block-heading\">NetworkPolicy \u0641\u064a Kubernetes \u0644\u0628\u0648\u062f\u0627\u062a \u0627\u0644\u0640 Runner<\/h3>\n\n<p class=\"wp-block-paragraph\">\u0625\u0630\u0627 \u0634\u063a\u0651\u0644\u062a runners \u0627\u0644\u062e\u0627\u0635\u0629 \u0628\u0640 CI\/CD \u0639\u0644\u0649 Kubernetes (\u0645\u062b\u0644\u0627\u064b \u0628\u0627\u0633\u062a\u062e\u062f\u0627\u0645 Actions Runner Controller \u0623\u0648 \u0645\u064f\u0646\u0641\u0650\u0651\u0630 GitLab \u0644\u0640 Kubernetes)\u060c \u0641\u0625\u0646 \u0645\u0648\u0627\u0631\u062f NetworkPolicy \u062a\u0645\u0646\u062d\u0643 \u062a\u062d\u0643\u0645\u0627\u064b \u062f\u0642\u064a\u0642\u0627\u064b \u0641\u064a \u0627\u0644\u0648\u0635\u0648\u0644 \u0627\u0644\u0634\u0628\u0643\u064a \u0639\u0644\u0649 \u0645\u0633\u062a\u0648\u0649 \u0627\u0644\u0628\u0648\u062f. \u0648\u062a\u062d\u0631\u0645 \u0627\u0644\u0633\u064a\u0627\u0633\u0629 \u0627\u0644\u0645\u0635\u0645\u064e\u0651\u0645\u0629 \u062c\u064a\u062f\u0627\u064b \u0643\u0644 \u062d\u0631\u0643\u0629 \u0635\u0627\u062f\u0631\u0629 (egress) \u0627\u0641\u062a\u0631\u0627\u0636\u064a\u0627\u064b\u060c \u062b\u0645 \u062a\u0633\u0645\u062d \u0641\u0642\u0637 \u0628\u0646\u0642\u0627\u0637 \u0627\u0644\u0646\u0647\u0627\u064a\u0629 \u0627\u0644\u0645\u062d\u062f\u0651\u062f\u0629 \u0627\u0644\u062a\u064a \u064a\u062d\u062a\u0627\u062c\u0647\u0627 \u0627\u0644\u0640 build.<\/p>\n\n<pre><code>apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: ci-runner-netpol\n  namespace: ci-runners\nspec:\n  podSelector:\n    matchLabels:\n      app: ci-runner\n  policyTypes:\n    - Egress\n  egress:\n    # Allow DNS resolution\n    - to:\n        - namespaceSelector: {}\n      ports:\n        - protocol: UDP\n          port: 53\n        - protocol: TCP\n          port: 53\n    # Allow access to container registry\n    - to:\n        - ipBlock:\n            cidr: 10.0.50.0\/24\n      ports:\n        - protocol: TCP\n          port: 443\n    # Allow access to artifact storage\n    - to:\n        - ipBlock:\n            cidr: 10.0.60.0\/24\n      ports:\n        - protocol: TCP\n          port: 443\n    # Deny everything else by omission<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\">\u062a\u0633\u0645\u062d \u0647\u0630\u0647 \u0627\u0644\u0633\u064a\u0627\u0633\u0629 \u0644\u0628\u0648\u062f\u0627\u062a \u0627\u0644\u0640 runner \u0628\u062a\u062d\u0644\u064a\u0644 DNS\u060c \u0648\u0627\u0644\u0648\u0635\u0648\u0644 \u0625\u0644\u0649 \u0633\u062c\u0644 \u0627\u0644\u062d\u0627\u0648\u064a\u0627\u062a\u060c \u0648\u0627\u0644\u0648\u0635\u0648\u0644 \u0625\u0644\u0649 \u062a\u062e\u0632\u064a\u0646 \u0627\u0644\u0640 artifacts \u2014 \u0644\u0627 \u0634\u064a\u0621 \u063a\u064a\u0631 \u0630\u0644\u0643. \u0648\u0643\u0644 \u0627\u062a\u0635\u0627\u0644 \u0635\u0627\u062f\u0631 \u0622\u062e\u0631 \u064a\u064f\u0633\u0642\u064e\u0637. \u0648\u0625\u0630\u0627 \u0643\u0646\u062a \u062a\u0633\u062a\u062e\u062f\u0645 \u0625\u0636\u0627\u0641\u0629 CNI \u062a\u062f\u0639\u0645 NetworkPolicy (Calico \u0623\u0648 Cilium \u0623\u0648 Weave Net)\u060c \u0641\u0625\u0646 \u0647\u0630\u0627 \u064a\u0633\u0631\u064a \u0641\u0648\u0631\u0627\u064b \u0639\u0646\u062f \u062a\u0637\u0628\u064a\u0642\u0647.<\/p>\n\n<p class=\"wp-block-paragraph\">\u0644\u062a\u062d\u0643\u0645 \u0623\u062f\u0642\u0651\u060c \u062a\u062f\u0639\u0645 <code>CiliumNetworkPolicy<\/code> \u0645\u0646 Cilium \u0642\u0648\u0627\u0639\u062f \u0642\u0627\u0626\u0645\u0629 \u0639\u0644\u0649 DNS\u060c \u0645\u0627 \u064a\u062a\u064a\u062d \u0644\u0643 \u062a\u062d\u062f\u064a\u062f \u0623\u0633\u0645\u0627\u0621 \u0627\u0644\u0646\u0637\u0627\u0642\u0627\u062a \u0628\u062f\u0644\u0627\u064b \u0645\u0646 \u0643\u062a\u0644 IP:<\/p>\n\n<pre><code>apiVersion: cilium.io\/v2\nkind: CiliumNetworkPolicy\nmetadata:\n  name: ci-runner-cilium-policy\n  namespace: ci-runners\nspec:\n  endpointSelector:\n    matchLabels:\n      app: ci-runner\n  egress:\n    - toEndpoints:\n        - matchLabels:\n            io.kubernetes.pod.namespace: kube-system\n            k8s-app: kube-dns\n      toPorts:\n        - ports:\n            - port: \"53\"\n              protocol: ANY\n    - toFQDNs:\n        - matchName: \"ghcr.io\"\n        - matchName: \"registry.npmjs.org\"\n        - matchName: \"pypi.org\"\n      toPorts:\n        - ports:\n            - port: \"443\"\n              protocol: TCP<\/code><\/pre>\n\n<h3 class=\"wp-block-heading\">Docker &#8211;network=none<\/h3>\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u0644\u0646\u0633\u0628\u0629 \u0644\u062e\u0637\u0648\u0627\u062a \u0627\u0644\u0640 build \u0627\u0644\u0642\u0627\u0626\u0645\u0629 \u0639\u0644\u0649 Docker \u0648\u0627\u0644\u062a\u064a \u0644\u0627 \u064a\u0646\u0628\u063a\u064a \u0623\u0646 \u062a\u062d\u062a\u0627\u062c \u0625\u0644\u0649 \u0623\u064a \u0648\u0635\u0648\u0644 \u0634\u0628\u0643\u064a (\u0627\u0644\u062a\u0635\u0631\u064a\u0641\u060c \u0648\u0627\u0644\u062a\u062d\u0644\u064a\u0644 \u0627\u0644\u0633\u0627\u0643\u0646\u060c \u0648\u0627\u062e\u062a\u0628\u0627\u0631\u0627\u062a \u0627\u0644\u0648\u062d\u062f\u0629)\u060c \u064a\u0645\u0643\u0646\u0643 \u0625\u0632\u0627\u0644\u0629 \u0627\u0644\u0648\u0635\u0648\u0644 \u0627\u0644\u0634\u0628\u0643\u064a \u0628\u0627\u0644\u0643\u0627\u0645\u0644 \u0628\u062a\u0634\u063a\u064a\u0644 \u0627\u0644\u062d\u0627\u0648\u064a\u0629 \u0628\u0640 <code>--network=none<\/code>:<\/p>\n\n<pre><code>docker run --network=none \\\n  --rm \\\n  -v \"$(pwd)\/src:\/workspace:ro\" \\\n  -v \"$(pwd)\/output:\/output\" \\\n  my-build-image:latest \\\n  make build<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\">\u0645\u0639 <code>--network=none<\/code>\u060c \u0644\u0627 \u062a\u0645\u0644\u0643 \u0627\u0644\u062d\u0627\u0648\u064a\u0629 \u0623\u064a \u0648\u0627\u062c\u0647\u0627\u062a \u0634\u0628\u0643\u064a\u0629 \u0639\u0644\u0649 \u0627\u0644\u0625\u0637\u0644\u0627\u0642 \u2014 \u0648\u0644\u0627 \u062d\u062a\u0649 loopback \u0641\u064a \u0628\u0639\u0636 \u0627\u0644\u062a\u0647\u064a\u0626\u0627\u062a. \u0648\u0647\u0630\u0627 \u0623\u0642\u0648\u0649 \u0639\u0632\u0644 \u0634\u0628\u0643\u064a \u064a\u0645\u0643\u0646\u0643 \u062a\u062d\u0642\u064a\u0642\u0647 \u0644\u062e\u0637\u0648\u0629 build. \u0648\u0627\u0644\u0645\u0641\u062a\u0627\u062d \u0647\u0648 \u0623\u0646 \u062a\u0628\u0646\u064a \u062e\u0637 \u0623\u0646\u0627\u0628\u064a\u0628\u0643 \u0628\u062d\u064a\u062b \u064a\u062d\u062f\u062b \u062c\u0644\u0628 \u0627\u0644\u062a\u0628\u0639\u064a\u0627\u062a \u0641\u064a \u0645\u0631\u062d\u0644\u0629 \u0648\u0627\u062d\u062f\u0629 (\u0628\u0648\u0635\u0648\u0644 \u0634\u0628\u0643\u064a \u0645\u062d\u062f\u0648\u062f) \u0648\u064a\u062d\u062f\u062b \u0627\u0644\u0640 build \u0627\u0644\u0641\u0639\u0644\u064a \u0641\u064a \u0645\u0631\u062d\u0644\u0629 \u0645\u0646\u0641\u0635\u0644\u0629 \u0628\u0644\u0627 \u0634\u0628\u0643\u0629.<\/p>\n\n<h3 class=\"wp-block-heading\">\u0642\u0648\u0627\u0639\u062f \u062c\u062f\u0627\u0631 \u0627\u0644\u062d\u0645\u0627\u064a\u0629 \u0644\u0644\u0640 runners \u0630\u0627\u062a\u064a\u0629 \u0627\u0644\u0627\u0633\u062a\u0636\u0627\u0641\u0629<\/h3>\n\n<p class=\"wp-block-paragraph\">\u0625\u0630\u0627 \u0643\u0646\u062a \u062a\u0633\u062a\u062e\u062f\u0645 runners \u0630\u0627\u062a\u064a\u0629 \u0627\u0644\u0627\u0633\u062a\u0636\u0627\u0641\u0629 \u0639\u0644\u0649 \u0623\u062c\u0647\u0632\u0629 \u0627\u0641\u062a\u0631\u0627\u0636\u064a\u0629 \u0628\u062f\u0644\u0627\u064b \u0645\u0646 \u0627\u0644\u062d\u0627\u0648\u064a\u0627\u062a\u060c \u0641\u0625\u0646 \u0642\u0648\u0627\u0639\u062f \u062c\u062f\u0627\u0631 \u0627\u0644\u062d\u0645\u0627\u064a\u0629 \u0639\u0644\u0649 \u0645\u0633\u062a\u0648\u0649 \u0627\u0644\u0645\u0636\u064a\u0641 \u062a\u0648\u0641\u0651\u0631 \u062d\u0645\u0627\u064a\u0629 \u0645\u0643\u0627\u0641\u0626\u0629. \u0639\u0644\u0649 Linux\u060c \u064a\u0645\u0643\u0646 \u0644\u0642\u0648\u0627\u0639\u062f <code>iptables<\/code> \u0623\u0648 <code>nftables<\/code> \u0623\u0646 \u062a\u0642\u064a\u0651\u062f \u0627\u0644\u062d\u0631\u0643\u0629 \u0627\u0644\u0635\u0627\u062f\u0631\u0629 \u0645\u0646 \u062d\u0633\u0627\u0628 \u0627\u0644\u0645\u0633\u062a\u062e\u062f\u0645 \u0627\u0644\u0630\u064a \u064a\u0634\u063a\u0651\u0644 \u0645\u0647\u0627\u0645 \u0627\u0644\u0640 CI:<\/p>\n\n<pre><code># Allow DNS\niptables -A OUTPUT -m owner --uid-owner ci-runner -p udp --dport 53 -j ACCEPT\niptables -A OUTPUT -m owner --uid-owner ci-runner -p tcp --dport 53 -j ACCEPT\n\n# Allow HTTPS to specific registries\niptables -A OUTPUT -m owner --uid-owner ci-runner -p tcp --dport 443 \\\n  -d registry.example.com -j ACCEPT\niptables -A OUTPUT -m owner --uid-owner ci-runner -p tcp --dport 443 \\\n  -d ghcr.io -j ACCEPT\n\n# Deny all other outbound traffic from the CI runner\niptables -A OUTPUT -m owner --uid-owner ci-runner -j DROP<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\">\u064a\u0639\u0645\u0644 \u0647\u0630\u0627 \u0627\u0644\u0646\u0647\u062c \u062c\u064a\u062f\u0627\u064b \u062d\u064a\u0646 \u062a\u0634\u063a\u0651\u0644 \u0648\u0643\u064a\u0644 \u0627\u0644\u0640 CI \u062a\u062d\u062a \u062d\u0633\u0627\u0628 \u0645\u0633\u062a\u062e\u062f\u0645 \u0645\u062e\u0635\u0651\u0635 \u0648\u062a\u062d\u062a\u0627\u062c \u0625\u0644\u0649 \u0627\u0644\u0633\u0645\u0627\u062d \u0644\u0646\u0638\u0627\u0645 \u0627\u0644\u0645\u0636\u064a\u0641 \u0646\u0641\u0633\u0647 \u0628\u0627\u0644\u062d\u0641\u0627\u0638 \u0639\u0644\u0649 \u0627\u062a\u0635\u0627\u0644 \u0623\u0648\u0633\u0639 \u0644\u0623\u063a\u0631\u0627\u0636 \u0627\u0644\u0625\u062f\u0627\u0631\u0629 \u0648\u0627\u0644\u062a\u062d\u062f\u064a\u062b\u0627\u062a.<\/p>\n\n<h3 class=\"wp-block-heading\">\u0648\u0636\u0639 \u0627\u0644\u0633\u062c\u0644\u0627\u062a \u0648\u0648\u0627\u062c\u0647\u0627\u062a API \u0641\u064a \u0642\u0627\u0626\u0645\u0629 \u0627\u0644\u0633\u0645\u0627\u062d<\/h3>\n\n<p class=\"wp-block-paragraph\">\u0628\u0635\u0631\u0641 \u0627\u0644\u0646\u0638\u0631 \u0639\u0646 \u0622\u0644\u064a\u0629 \u0627\u0644\u0641\u0631\u0636\u060c \u0627\u0644\u0645\u0628\u062f\u0623 \u0648\u0627\u062d\u062f: \u0627\u0645\u0646\u0639 \u0627\u0644\u062d\u0631\u0643\u0629 \u0627\u0644\u0635\u0627\u062f\u0631\u0629 \u0627\u0641\u062a\u0631\u0627\u0636\u064a\u0627\u064b\u060c \u062b\u0645 \u0627\u0633\u0645\u062d \u0641\u0642\u0637 \u0628\u0645\u0627 \u064a\u062d\u062a\u0627\u062c\u0647 \u0627\u0644\u0640 build \u0641\u0639\u0644\u0627\u064b. \u0648\u0639\u0627\u062f\u0629\u064b \u0645\u0627 \u062a\u0634\u0645\u0644 \u0642\u0627\u0626\u0645\u0629 \u0627\u0644\u0633\u0645\u0627\u062d \u0627\u0644\u0646\u0645\u0648\u0630\u062c\u064a\u0629 \u0633\u062c\u0644 \u0627\u0644\u062d\u0632\u0645 (npm\u060c PyPI\u060c Maven Central)\u060c \u0648\u0633\u062c\u0644 \u0627\u0644\u062d\u0627\u0648\u064a\u0627\u062a (Docker Hub\u060c GHCR\u060c ECR)\u060c \u0648\u0648\u0627\u062c\u0647\u0629 API \u0644\u0645\u0646\u0635\u0629 \u0627\u0644\u0640 CI\/CD (\u0644\u062a\u062d\u062f\u064a\u062b\u0627\u062a \u0627\u0644\u062d\u0627\u0644\u0629 \u0648\u0631\u0641\u0639 \u0627\u0644\u0640 artifacts)\u060c \u0648\u0631\u0628\u0645\u0627 \u0648\u0643\u064a\u0644\u0627\u064b (proxy) \u0623\u0648 \u0645\u0631\u0622\u0629 (mirror) \u062a\u062a\u062d\u0643\u0645 \u0641\u064a\u0647\u0627. \u0648\u064a\u0646\u0628\u063a\u064a \u062d\u062c\u0628 \u0643\u0644 \u0645\u0627 \u0639\u062f\u0627 \u0630\u0644\u0643. \u0627\u0633\u062a\u062e\u062f\u0645 \u0648\u0643\u064a\u0644\u0627\u064b \u0623\u0648 \u0645\u0631\u0622\u0629 \u062f\u0627\u062e\u0644\u064a\u0629 \u0644\u0644\u062a\u0628\u0639\u064a\u0627\u062a \u0643\u0644\u0645\u0627 \u0623\u0645\u0643\u0646 \u2014 \u0641\u0647\u0630\u0627 \u064a\u0642\u0644\u0651\u0635 \u0642\u0627\u0626\u0645\u0629 \u0627\u0644\u0633\u0645\u0627\u062d \u0625\u0644\u0649 \u0646\u0642\u0637\u0629 \u0646\u0647\u0627\u064a\u0629 \u0648\u0627\u062d\u062f\u0629\u060c \u0648\u064a\u0645\u0646\u062d\u0643 \u0627\u0644\u062a\u062e\u0632\u064a\u0646 \u0627\u0644\u0645\u0624\u0642\u062a \u0648\u062a\u0633\u062c\u064a\u0644 \u0627\u0644\u062a\u062f\u0642\u064a\u0642 \u0645\u062c\u0627\u0646\u0627\u064b.<\/p>\n\n<h2 class=\"wp-block-heading\">\u0642\u064a\u0648\u062f \u0646\u0638\u0627\u0645 \u0627\u0644\u0645\u0644\u0641\u0627\u062a<\/h2>\n\n<p class=\"wp-block-paragraph\">\u062a\u0645\u0646\u0639 \u0627\u0644\u0642\u064a\u0648\u062f \u0627\u0644\u0634\u0628\u0643\u064a\u0629 \u0627\u0644\u0628\u064a\u0627\u0646\u0627\u062a \u0645\u0646 \u0645\u063a\u0627\u062f\u0631\u0629 \u0628\u064a\u0626\u0629 \u0627\u0644\u0640 build. \u0648\u062a\u0645\u0646\u0639 \u0642\u064a\u0648\u062f \u0646\u0638\u0627\u0645 \u0627\u0644\u0645\u0644\u0641\u0627\u062a \u0627\u0644\u062a\u0639\u062f\u064a\u0644\u0627\u062a \u063a\u064a\u0631 \u0627\u0644\u0645\u0635\u0631\u0651\u062d \u0628\u0647\u0627 \u062f\u0627\u062e\u0644\u0647\u0627. \u0648\u0645\u0639\u0627\u064b\u060c \u062a\u0634\u0643\u0651\u0644\u0627\u0646 \u0648\u0636\u0639\u064a\u0629 \u0642\u0648\u064a\u0629 \u0644\u0644\u062f\u0641\u0627\u0639 \u0641\u064a \u0627\u0644\u0639\u0645\u0642 (defense-in-depth).<\/p>\n\n<h3 class=\"wp-block-heading\">\u0646\u0638\u0627\u0645 \u0645\u0644\u0641\u0627\u062a \u062c\u0630\u0631\u064a \u0644\u0644\u0642\u0631\u0627\u0621\u0629 \u0641\u0642\u0637<\/h3>\n\n<p class=\"wp-block-paragraph\">\u062a\u0634\u063a\u064a\u0644 \u062d\u0627\u0648\u064a\u0627\u062a \u0627\u0644\u0640 build \u0628\u0646\u0638\u0627\u0645 \u0645\u0644\u0641\u0627\u062a \u062c\u0630\u0631\u064a \u0644\u0644\u0642\u0631\u0627\u0621\u0629 \u0641\u0642\u0637 \u064a\u0645\u0646\u0639 \u0623\u064a \u0639\u0645\u0644\u064a\u0629 \u0645\u0646 \u062a\u0639\u062f\u064a\u0644 \u0627\u0644\u0635\u0648\u0631\u0629 \u0627\u0644\u0623\u0633\u0627\u0633\u064a\u0629. \u0648\u064a\u062d\u062c\u0628 \u0630\u0644\u0643 \u0641\u0626\u0629 \u0645\u0646 \u0627\u0644\u0647\u062c\u0645\u0627\u062a \u062a\u0639\u062f\u0651\u0644 \u0641\u064a\u0647\u0627 \u0627\u0644\u0634\u064a\u0641\u0631\u0629 \u0627\u0644\u062e\u0628\u064a\u062b\u0629 \u0627\u0644\u0645\u0644\u0641\u0627\u062a \u0627\u0644\u062b\u0646\u0627\u0626\u064a\u0629 \u0644\u0644\u0646\u0638\u0627\u0645\u060c \u0623\u0648 \u062a\u062b\u0628\u0651\u062a \u0623\u0628\u0648\u0627\u0628\u0627\u064b \u062e\u0644\u0641\u064a\u0629\u060c \u0623\u0648 \u062a\u063a\u064a\u0651\u0631 \u062a\u0647\u064a\u0626\u0629 \u0623\u062f\u0648\u0627\u062a \u0627\u0644\u0640 build \u0639\u0644\u0649 \u0645\u0633\u062a\u0648\u0649 \u0627\u0644\u0646\u0638\u0627\u0645.<\/p>\n\n<p class=\"wp-block-paragraph\">\u0641\u064a Docker\u060c \u0627\u0633\u062a\u062e\u062f\u0645 \u0627\u0644\u0631\u0627\u064a\u0629 <code>--read-only<\/code>:<\/p>\n\n<pre><code>docker run --read-only \\\n  --tmpfs \/tmp:rw,noexec,nosuid,size=512m \\\n  --tmpfs \/workspace\/build:rw,size=2g \\\n  -v \"$(pwd)\/src:\/workspace\/src:ro\" \\\n  my-build-image:latest \\\n  make build<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\">\u0641\u064a Kubernetes\u060c \u0627\u0636\u0628\u0637 \u0633\u064a\u0627\u0642 \u0627\u0644\u0623\u0645\u0627\u0646 (security context) \u0641\u064a \u0645\u0648\u0627\u0635\u0641\u0627\u062a \u0627\u0644\u0628\u0648\u062f:<\/p>\n\n<pre><code>apiVersion: v1\nkind: Pod\nmetadata:\n  name: ci-build-pod\nspec:\n  containers:\n    - name: build\n      image: my-build-image:latest\n      securityContext:\n        readOnlyRootFilesystem: true\n        runAsNonRoot: true\n        allowPrivilegeEscalation: false\n      volumeMounts:\n        - name: build-tmp\n          mountPath: \/tmp\n        - name: build-output\n          mountPath: \/workspace\/build\n        - name: source\n          mountPath: \/workspace\/src\n          readOnly: true\n  volumes:\n    - name: build-tmp\n      emptyDir:\n        medium: Memory\n        sizeLimit: 512Mi\n    - name: build-output\n      emptyDir:\n        sizeLimit: 2Gi\n    - name: source\n      configMap:\n        name: source-code<\/code><\/pre>\n\n<h3 class=\"wp-block-heading\">tmpfs \u0644\u0640 artifacts \u0627\u0644\u0640 build<\/h3>\n\n<p class=\"wp-block-paragraph\">\u0639\u0646\u062f\u0645\u0627 \u064a\u0643\u0648\u0646 \u0646\u0638\u0627\u0645 \u0627\u0644\u0645\u0644\u0641\u0627\u062a \u0627\u0644\u062c\u0630\u0631\u064a \u0644\u0644\u0642\u0631\u0627\u0621\u0629 \u0641\u0642\u0637\u060c \u062a\u062d\u062a\u0627\u062c \u0639\u0645\u0644\u064a\u0627\u062a \u0627\u0644\u0640 build \u0625\u0644\u0649 \u0645\u0633\u0627\u062d\u0629 \u0642\u0627\u0628\u0644\u0629 \u0644\u0644\u0643\u062a\u0627\u0628\u0629 \u0644\u0644\u0645\u0644\u0641\u0627\u062a \u0627\u0644\u0645\u0624\u0642\u062a\u0629\u060c \u0648\u0630\u0648\u0627\u0643\u0631 \u0627\u0644\u062a\u062e\u0632\u064a\u0646 \u0627\u0644\u0645\u0624\u0642\u062a\u060c \u0648artifacts \u0627\u0644\u0645\u062e\u0631\u062c\u0627\u062a. \u0627\u0633\u062a\u062e\u062f\u0645 \u0639\u0645\u0644\u064a\u0627\u062a \u062a\u0631\u0643\u064a\u0628 <code>tmpfs<\/code> (\u0627\u0644\u0645\u062f\u0639\u0648\u0645\u0629 \u0628\u0630\u0627\u0643\u0631\u0629 RAM) \u0623\u0648 \u0623\u062d\u062c\u0627\u0645 <code>emptyDir<\/code> (\u0641\u064a Kubernetes) \u0644\u0647\u0630\u0647 \u0627\u0644\u0645\u0633\u0627\u0631\u0627\u062a. \u0648\u0644\u0647\u0630\u0627 \u0641\u0627\u0626\u062f\u0629 \u0625\u0636\u0627\u0641\u064a\u0629 \u0647\u064a \u0623\u0646 \u062c\u0645\u064a\u0639 artifacts \u0627\u0644\u0640 build \u062a\u064f\u0646\u0638\u064e\u0651\u0641 \u062a\u0644\u0642\u0627\u0626\u064a\u0627\u064b \u0639\u0646\u062f \u062e\u0631\u0648\u062c \u0627\u0644\u062d\u0627\u0648\u064a\u0629 \u2014 \u0641\u0644\u0627 \u062a\u0628\u0642\u0649 \u0628\u064a\u0627\u0646\u0627\u062a \u0642\u062f\u064a\u0645\u0629 \u0628\u064a\u0646 \u0639\u0645\u0644\u064a\u0627\u062a \u0627\u0644\u0640 build.<\/p>\n\n<p class=\"wp-block-paragraph\">\u0631\u0643\u0651\u0628 <code>tmpfs<\/code> \u0628\u062e\u064a\u0627\u0631\u0627\u062a \u0645\u0642\u064a\u0651\u062f\u0629 \u0643\u0644\u0645\u0627 \u0623\u0645\u0643\u0646: <code>noexec<\/code> \u064a\u0645\u0646\u0639 \u062a\u0646\u0641\u064a\u0630 \u0627\u0644\u0645\u0644\u0641\u0627\u062a \u0627\u0644\u062b\u0646\u0627\u0626\u064a\u0629 \u0627\u0644\u0645\u0643\u062a\u0648\u0628\u0629 \u0641\u064a \u0627\u0644\u0645\u062c\u0644\u062f\u0627\u062a \u0627\u0644\u0645\u0624\u0642\u062a\u0629 (\u0645\u0627 \u064a\u062d\u062c\u0628 \u0645\u062a\u062c\u0647 \u0647\u062c\u0648\u0645 \u0634\u0627\u0626\u0639\u0627\u064b)\u060c \u0648<code>nosuid<\/code> \u064a\u0645\u0646\u0639 \u0647\u062c\u0645\u0627\u062a \u0628\u0650\u062a\u0651 SUID\u060c \u0648\u062d\u062f\u0648\u062f <code>size<\/code> \u062a\u0645\u0646\u0639 build \u062c\u0627\u0645\u062d\u0627\u064b \u0645\u0646 \u0627\u0633\u062a\u0646\u0632\u0627\u0641 \u0630\u0627\u0643\u0631\u0629 \u0627\u0644\u0645\u0636\u064a\u0641.<\/p>\n\n<h3 class=\"wp-block-heading\">\u0645\u0646\u0639 \u0627\u0644\u0643\u062a\u0627\u0628\u0629 \u0641\u064a \u0627\u0644\u0645\u0633\u0627\u0631\u0627\u062a \u0627\u0644\u062d\u0633\u0627\u0633\u0629<\/h3>\n\n<p class=\"wp-block-paragraph\">\u0625\u0644\u0649 \u062c\u0627\u0646\u0628 \u0646\u0638\u0627\u0645 \u0627\u0644\u0645\u0644\u0641\u0627\u062a \u0627\u0644\u062c\u0630\u0631\u064a\u060c \u062a\u0633\u062a\u062d\u0642 \u0645\u0633\u0627\u0631\u0627\u062a \u0645\u062d\u062f\u0651\u062f\u0629 \u062d\u0645\u0627\u064a\u0629 \u0625\u0636\u0627\u0641\u064a\u0629. \u0631\u0643\u0651\u0628 \u0627\u0644\u0634\u064a\u0641\u0631\u0629 \u0627\u0644\u0645\u0635\u062f\u0631\u064a\u0629 \u0644\u0644\u0642\u0631\u0627\u0621\u0629 \u0641\u0642\u0637 \u0644\u0645\u0646\u0639 \u0627\u0644\u0640 build \u0645\u0646 \u062a\u0639\u062f\u064a\u0644 \u0645\u062f\u062e\u0644\u0627\u062a\u0647 \u0627\u0644\u062e\u0627\u0635\u0629. \u0648\u062a\u0623\u0643\u0651\u062f \u0645\u0646 \u0623\u0646 <code>\/etc<\/code> \u0648<code>\/usr<\/code> \u0648<code>\/var<\/code> \u063a\u064a\u0631 \u0642\u0627\u0628\u0644\u0629 \u0644\u0644\u0643\u062a\u0627\u0628\u0629. \u0648\u0625\u0630\u0627 \u0643\u0627\u0646 \u0627\u0644\u0640 build \u064a\u062d\u062a\u0627\u062c \u0625\u0644\u0649 \u0627\u0644\u0643\u062a\u0627\u0628\u0629 \u0641\u064a \u0645\u062c\u0644\u062f \u0627\u0644\u0645\u0646\u0632\u0644 (home directory) \u0644\u062a\u0647\u064a\u0626\u0629 \u0627\u0644\u0623\u062f\u0648\u0627\u062a\u060c \u0641\u0648\u0641\u0651\u0631 \u0639\u0645\u0644\u064a\u0629 \u062a\u0631\u0643\u064a\u0628 \u0645\u062e\u0635\u0651\u0635\u0629 \u0642\u0627\u0628\u0644\u0629 \u0644\u0644\u0643\u062a\u0627\u0628\u0629 \u0628\u062f\u0644\u0627\u064b \u0645\u0646 \u062c\u0639\u0644 \u0645\u062c\u0644\u062f \u0627\u0644\u0645\u0646\u0632\u0644 \u0628\u0623\u0643\u0645\u0644\u0647 \u0642\u0627\u0628\u0644\u0627\u064b \u0644\u0644\u0643\u062a\u0627\u0628\u0629. \u0648\u0627\u062d\u062c\u0628 \u0627\u0644\u0648\u0635\u0648\u0644 \u0625\u0644\u0649 \u0645\u0642\u0627\u0628\u0633 Docker (Docker sockets)\u060c \u0648\u0631\u0645\u0648\u0632 \u062d\u0633\u0627\u0628\u0627\u062a \u062e\u062f\u0645\u0629 Kubernetes\u060c \u0648\u0645\u0644\u0641\u0627\u062a \u0628\u064a\u0627\u0646\u0627\u062a \u0627\u0644\u0627\u0639\u062a\u0645\u0627\u062f \u0627\u0644\u0633\u062d\u0627\u0628\u064a\u0629 \u0628\u0639\u062f\u0645 \u062a\u0631\u0643\u064a\u0628\u0647\u0627 \u0641\u064a \u062d\u0627\u0648\u064a\u0627\u062a \u0627\u0644\u0640 build \u0639\u0644\u0649 \u0627\u0644\u0625\u0637\u0644\u0627\u0642.<\/p>\n\n<h2 class=\"wp-block-heading\">\u0639\u0645\u0644\u064a\u0627\u062a \u0627\u0644\u0640 build \u0627\u0644\u0645\u064f\u062d\u0643\u064e\u0645\u0629 (Hermetic)<\/h2>\n\n<p class=\"wp-block-paragraph\">\u0627\u0644\u0645\u0639\u064a\u0627\u0631 \u0627\u0644\u0630\u0647\u0628\u064a \u0644\u0623\u0645\u0646 \u0628\u064a\u0626\u0629 \u0627\u0644\u0640 build \u0647\u0648 \u0627\u0644\u0640 build \u0627\u0644\u0645\u064f\u062d\u0643\u064e\u0645 (hermetic): \u0628\u0646\u0627\u0621 \u0644\u0627 \u064a\u0645\u0644\u0643 \u0623\u064a \u0648\u0635\u0648\u0644 \u0634\u0628\u0643\u064a \u0639\u0644\u0649 \u0627\u0644\u0625\u0637\u0644\u0627\u0642 \u0648\u064a\u0633\u062a\u062e\u062f\u0645 \u0641\u0642\u0637 \u0645\u062f\u062e\u0644\u0627\u062a \u0645\u064f\u0639\u0644\u064e\u0646\u0629 \u0635\u0631\u0627\u062d\u0629\u064b \u0648\u0645\u064f\u062c\u0644\u0648\u0628\u0629 \u0645\u0633\u0628\u0642\u0627\u064b. \u0648\u062a\u0642\u0636\u064a \u0639\u0645\u0644\u064a\u0627\u062a \u0627\u0644\u0640 build \u0627\u0644\u0645\u064f\u062d\u0643\u064e\u0645\u0629 \u0639\u0644\u0649 \u0641\u0626\u0627\u062a \u0643\u0627\u0645\u0644\u0629 \u0645\u0646 \u0647\u062c\u0645\u0627\u062a \u0633\u0644\u0633\u0644\u0629 \u0627\u0644\u062a\u0648\u0631\u064a\u062f\u060c \u0644\u0623\u0646 \u0639\u0645\u0644\u064a\u0629 \u0627\u0644\u0640 build \u0644\u0627 \u062a\u0633\u062a\u0637\u064a\u0639 \u062a\u0646\u0632\u064a\u0644 \u0634\u064a\u0641\u0631\u0629 \u0644\u0645 \u062a\u064f\u062d\u062f\u064e\u0651\u062f \u0648\u062a\u064f\u062a\u062d\u0642\u064e\u0651\u0642 \u0645\u0646\u0647\u0627 \u0635\u0631\u0627\u062d\u0629\u064b.<\/p>\n\n<h3 class=\"wp-block-heading\">\u0646\u0645\u0637 \u0627\u0644\u0640 build \u0627\u0644\u0645\u064f\u062d\u0643\u064e\u0645<\/h3>\n\n<p class=\"wp-block-paragraph\">\u064a\u062a\u0623\u0644\u0641 \u062e\u0637 \u0623\u0646\u0627\u0628\u064a\u0628 \u0627\u0644\u0640 build \u0627\u0644\u0645\u064f\u062d\u0643\u064e\u0645 \u0639\u0627\u062f\u0629\u064b \u0645\u0646 \u0645\u0631\u062d\u0644\u062a\u064a\u0646. \u0641\u064a \u0627\u0644\u0645\u0631\u062d\u0644\u0629 \u0627\u0644\u0623\u0648\u0644\u0649 (\u0645\u0631\u062d\u0644\u0629 \u0627\u0644\u062a\u062d\u0644\u064a\u0644\/\u0627\u0644\u062c\u0644\u0628)\u060c \u062a\u064f\u0646\u0632\u064e\u0651\u0644 \u0627\u0644\u062a\u0628\u0639\u064a\u0627\u062a \u0645\u0646 \u0645\u0635\u0627\u062f\u0631 \u0645\u0639\u062a\u0645\u064e\u062f\u0629\u060c \u0648\u064a\u064f\u062a\u062d\u0642\u064e\u0651\u0642 \u0645\u0646 \u0642\u064a\u0645 \u0627\u062e\u062a\u0628\u0627\u0631\u0647\u0627 (checksums) \u0645\u0642\u0627\u0628\u0644 \u0645\u0644\u0641 \u0642\u0641\u0644 (lockfile)\u060c \u0648\u062a\u064f\u062e\u0632\u064e\u0651\u0646 \u0641\u064a \u0630\u0627\u0643\u0631\u0629 \u062a\u062e\u0632\u064a\u0646 \u0645\u0624\u0642\u062a \u0645\u062d\u0644\u064a\u0629 \u0623\u0648 \u0645\u062c\u0644\u062f \u0645\u064f\u0648\u0631\u064e\u0651\u062f (vendored). \u0648\u062a\u062a\u0637\u0644\u0628 \u0647\u0630\u0647 \u0627\u0644\u0645\u0631\u062d\u0644\u0629 \u0648\u0635\u0648\u0644\u0627\u064b \u0634\u0628\u0643\u064a\u0627\u064b \u0645\u062d\u062f\u0648\u062f\u0627\u064b. \u0648\u0641\u064a \u0627\u0644\u0645\u0631\u062d\u0644\u0629 \u0627\u0644\u062b\u0627\u0646\u064a\u0629 (\u0645\u0631\u062d\u0644\u0629 \u0627\u0644\u0640 build)\u060c \u064a\u062d\u062f\u062b \u0627\u0644\u062a\u0635\u0631\u064a\u0641 \u0623\u0648 \u0627\u0644\u062a\u062c\u0645\u064a\u0639 \u0627\u0644\u0641\u0639\u0644\u064a \u0628\u0648\u0635\u0648\u0644 \u0634\u0628\u0643\u064a \u0635\u0641\u0631\u064a. \u0648\u062a\u0623\u062a\u064a \u062c\u0645\u064a\u0639 \u0627\u0644\u0645\u062f\u062e\u0644\u0627\u062a \u0645\u0646 \u0646\u0638\u0627\u0645 \u0627\u0644\u0645\u0644\u0641\u0627\u062a \u0627\u0644\u0645\u062d\u0644\u064a \u2014 \u0627\u0644\u0634\u064a\u0641\u0631\u0629 \u0627\u0644\u0645\u0635\u062f\u0631\u064a\u0629 \u0648\u0627\u0644\u062a\u0628\u0639\u064a\u0627\u062a \u0627\u0644\u0645\u064f\u062c\u0644\u0648\u0628\u0629 \u0645\u0633\u0628\u0642\u0627\u064b.<\/p>\n\n<pre><code># Phase 1: Fetch dependencies (limited network)\ndocker run --network=ci-restricted \\\n  -v \"$(pwd):\/workspace\" \\\n  my-build-image:latest \\\n  sh -c \"cd \/workspace && npm ci --ignore-scripts\"\n\n# Phase 2: Build (no network)\ndocker run --network=none \\\n  --read-only \\\n  --tmpfs \/tmp:rw,noexec,size=512m \\\n  -v \"$(pwd):\/workspace:ro\" \\\n  -v \"$(pwd)\/dist:\/dist\" \\\n  my-build-image:latest \\\n  sh -c \"cd \/workspace && npm run build && cp -r build\/* \/dist\/\"<\/code><\/pre>\n\n<h3 class=\"wp-block-heading\">Bazel \u0648\u0639\u0645\u0644\u064a\u0627\u062a \u0627\u0644\u0640 build \u0627\u0644\u0645\u064f\u062d\u0643\u064e\u0645\u0629<\/h3>\n\n<p class=\"wp-block-paragraph\">\u0635\u064f\u0645\u0650\u0651\u0645 Bazel \u062d\u0648\u0644 \u0645\u0628\u062f\u0623 \u0627\u0644\u0625\u062d\u0643\u0627\u0645 (hermeticity). \u0641\u0645\u0639 <code>--sandbox_default_allow_network=false<\/code>\u060c \u064a\u062d\u062c\u0628 Bazel \u0627\u0644\u0648\u0635\u0648\u0644 \u0627\u0644\u0634\u0628\u0643\u064a \u0623\u062b\u0646\u0627\u0621 \u0625\u062c\u0631\u0627\u0621\u0627\u062a \u0627\u0644\u0640 build \u0627\u0641\u062a\u0631\u0627\u0636\u064a\u0627\u064b. \u0648\u062a\u064f\u0639\u0644\u064e\u0646 \u0627\u0644\u062a\u0628\u0639\u064a\u0627\u062a \u0641\u064a \u0645\u0644\u0641\u0627\u062a <code>WORKSPACE<\/code> \u0623\u0648 <code>MODULE.bazel<\/code> \u0628\u0642\u064a\u0645 \u062a\u062c\u0632\u0626\u0629 SHA-256 \u0635\u0631\u064a\u062d\u0629\u060c \u0648\u064a\u062c\u0644\u0628\u0647\u0627 Bazel \u0641\u064a \u0645\u0631\u062d\u0644\u0629 \u0645\u0646\u0641\u0635\u0644\u0629 \u0642\u0628\u0644 \u0628\u062f\u0621 \u0627\u0644\u0640 build. \u0648\u0625\u0630\u0627 \u0644\u0645 \u062a\u0637\u0627\u0628\u0642 \u062a\u0628\u0639\u064a\u0629 \u0642\u064a\u0645\u0629 \u062a\u062c\u0632\u0626\u062a\u0647\u0627 \u0627\u0644\u0645\u064f\u0639\u0644\u064e\u0646\u0629\u060c \u0641\u0634\u0644 \u0627\u0644\u0640 build.<\/p>\n\n<pre><code># In .bazelrc\nbuild --sandbox_default_allow_network=false\nbuild --incompatible_strict_action_env\nfetch --repository_cache=\/shared\/bazel-cache\/repos<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\">\u0648\u0647\u0630\u0627 \u064a\u062c\u0639\u0644 \u0639\u0645\u0644\u064a\u0627\u062a build \u0627\u0644\u062e\u0627\u0635\u0629 \u0628\u0640 Bazel \u0642\u0627\u0628\u0644\u0629 \u0644\u0625\u0639\u0627\u062f\u0629 \u0627\u0644\u0625\u0646\u062a\u0627\u062c \u0648\u0645\u0642\u0627\u0648\u0650\u0645\u0629 \u0644\u0647\u062c\u0645\u0627\u062a \u0627\u0644\u062e\u0644\u0637 \u0628\u064a\u0646 \u0627\u0644\u062a\u0628\u0639\u064a\u0627\u062a (dependency confusion). \u0641\u0643\u0644 \u0645\u062f\u062e\u0644 \u0645\u064f\u0639\u0646\u0648\u064e\u0646 \u0628\u0645\u062d\u062a\u0648\u0627\u0647 (content-addressed) \u0648\u0645\u064f\u062a\u062d\u0642\u064e\u0651\u0642 \u0645\u0646\u0647.<\/p>\n\n<h3 class=\"wp-block-heading\">Nix \u0648\u0639\u0645\u0644\u064a\u0627\u062a \u0627\u0644\u0640 build \u0627\u0644\u0642\u0627\u0628\u0644\u0629 \u0644\u0625\u0639\u0627\u062f\u0629 \u0627\u0644\u0625\u0646\u062a\u0627\u062c<\/h3>\n\n<p class=\"wp-block-paragraph\">\u064a\u062a\u0628\u0639 Nix \u0646\u0647\u062c\u0627\u064b \u0645\u0645\u0627\u062b\u0644\u0627\u064b. \u0641\u0643\u0644 \u0627\u0634\u062a\u0642\u0627\u0642 build (derivation) \u064a\u062d\u062f\u0651\u062f \u0645\u062f\u062e\u0644\u0627\u062a\u0647 \u0628\u0642\u064a\u0645\u0629 \u062a\u062c\u0632\u0626\u0629 \u0627\u0644\u0645\u062d\u062a\u0648\u0649\u060c \u0648\u0635\u0646\u062f\u0648\u0642 build \u0627\u0644\u0631\u0645\u0644\u064a \u0641\u064a Nix \u064a\u062d\u062c\u0628 \u0627\u0644\u0648\u0635\u0648\u0644 \u0627\u0644\u0634\u0628\u0643\u064a \u0627\u0641\u062a\u0631\u0627\u0636\u064a\u0627\u064b. \u0648\u064a\u062c\u0644\u0628 \u0623\u0645\u0631 <code>nix-build<\/code> \u062c\u0645\u064a\u0639 \u0627\u0644\u0645\u0635\u0627\u062f\u0631 \u0625\u0644\u0649 \u0645\u062e\u0632\u0646 Nix (\u0645\u062a\u062d\u0642\u0651\u0642\u0627\u064b \u0645\u0646 \u0642\u064a\u0645 \u0627\u0644\u062a\u062c\u0632\u0626\u0629)\u060c \u062b\u0645 \u064a\u0634\u063a\u0651\u0644 \u0627\u0644\u0640 build \u0641\u064a \u0628\u064a\u0626\u0629 \u0645\u0639\u0632\u0648\u0644\u0629 \u0628\u0644\u0627 \u0634\u0628\u0643\u0629 \u0648\u0628\u0646\u0638\u0627\u0645 \u0645\u0644\u0641\u0627\u062a \u0645\u064f\u0642\u0644\u064e\u0651\u0635. \u0648\u064a\u0636\u0645\u0646 \u0630\u0644\u0643 \u0623\u0646 \u062a\u0643\u0648\u0646 \u0639\u0645\u0644\u064a\u0627\u062a \u0627\u0644\u0640 build \u0642\u0627\u0628\u0644\u0629 \u0644\u0625\u0639\u0627\u062f\u0629 \u0627\u0644\u0625\u0646\u062a\u0627\u062c \u2014 \u0641\u0627\u0644\u0645\u062f\u062e\u0644\u0627\u062a \u0646\u0641\u0633\u0647\u0627 \u062a\u0646\u062a\u062c \u0627\u0644\u0645\u062e\u0631\u062c\u0627\u062a \u0646\u0641\u0633\u0647\u0627 \u062f\u0627\u0626\u0645\u0627\u064b.<\/p>\n\n<h2 class=\"wp-block-heading\">\u0627\u0644\u062a\u0646\u0641\u064a\u0630 \u0627\u0644\u0639\u0645\u0644\u064a<\/h2>\n\n<p class=\"wp-block-paragraph\">\u0644\u0646\u0646\u0638\u0631 \u0641\u064a \u0643\u064a\u0641\u064a\u0629 \u062a\u0637\u0628\u064a\u0642 \u0647\u0630\u0647 \u0627\u0644\u0642\u064a\u0648\u062f \u0641\u064a \u0645\u0646\u0635\u0627\u062a CI\/CD \u0645\u062d\u062f\u0651\u062f\u0629.<\/p>\n\n<h3 class=\"wp-block-heading\">GitHub Actions \u0645\u0639 Actions Runner Controller (ARC) + NetworkPolicy<\/h3>\n\n<p class=\"wp-block-paragraph\">\u0625\u0630\u0627 \u0643\u0646\u062a \u062a\u0633\u062a\u062e\u062f\u0645 <a href=\"https:\/\/secure-pipelines.com\/ar\/ci-cd-security\/lab-ephemeral-self-hosted-runners-actions-runner-controller\/\">Actions Runner Controller<\/a> \u0644\u062a\u0634\u063a\u064a\u0644 GitHub Actions \u0639\u0644\u0649 Kubernetes\u060c \u0641\u064a\u0645\u0643\u0646\u0643 \u062a\u0637\u0628\u064a\u0642 NetworkPolicies \u0645\u0628\u0627\u0634\u0631\u0629\u064b \u0639\u0644\u0649 \u0628\u0648\u062f\u0627\u062a \u0627\u0644\u0640 runner. \u0641\u0640 ARC \u064a\u0646\u0634\u0626 \u0628\u0648\u062f\u0627\u062a \u0628\u0648\u0633\u0648\u0645 (labels) \u0645\u062a\u0648\u0642\u0651\u0639\u0629\u060c \u0645\u0627 \u064a\u062c\u0639\u0644\u0647\u0627 \u0633\u0647\u0644\u0629 \u0627\u0644\u0627\u0633\u062a\u0647\u062f\u0627\u0641 \u0628\u0627\u0644\u0633\u064a\u0627\u0633\u0627\u062a.<\/p>\n\n<pre><code>apiVersion: actions.summerwind.dev\/v1alpha1\nkind: RunnerDeployment\nmetadata:\n  name: secure-runner\n  namespace: ci-runners\nspec:\n  replicas: 3\n  template:\n    metadata:\n      labels:\n        app: ci-runner\n        security-tier: restricted\n    spec:\n      containers:\n        - name: runner\n          securityContext:\n            readOnlyRootFilesystem: true\n            runAsNonRoot: true\n            allowPrivilegeEscalation: false\n            capabilities:\n              drop:\n                - ALL\n          volumeMounts:\n            - name: work\n              mountPath: \/runner\/_work\n            - name: tmp\n              mountPath: \/tmp\n      volumes:\n        - name: work\n          emptyDir:\n            sizeLimit: 10Gi\n        - name: tmp\n          emptyDir:\n            medium: Memory\n            sizeLimit: 1Gi\n---\napiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: secure-runner-netpol\n  namespace: ci-runners\nspec:\n  podSelector:\n    matchLabels:\n      app: ci-runner\n  policyTypes:\n    - Egress\n    - Ingress\n  ingress: []\n  egress:\n    - to:\n        - namespaceSelector: {}\n      ports:\n        - protocol: UDP\n          port: 53\n    - to:\n        - ipBlock:\n            cidr: 0.0.0.0\/0\n      ports:\n        - protocol: TCP\n          port: 443<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\">\u062a\u062d\u0631\u0645 \u0647\u0630\u0647 \u0627\u0644\u062a\u0647\u064a\u0626\u0629 \u0643\u0644 \u062d\u0631\u0643\u0629 \u0648\u0627\u0631\u062f\u0629 (ingress) \u2014 \u0641\u0627\u0644\u0640 runners \u0644\u0627 \u064a\u0646\u0628\u063a\u064a \u0623\u0646 \u062a\u0642\u0628\u0644 \u0627\u062a\u0635\u0627\u0644\u0627\u062a \u0648\u0627\u0631\u062f\u0629 \u2014 \u0648\u062a\u0642\u0635\u0631 \u0627\u0644\u062d\u0631\u0643\u0629 \u0627\u0644\u0635\u0627\u062f\u0631\u0629 \u0639\u0644\u0649 DNS \u0648HTTPS. \u0648\u0644\u0644\u0627\u0633\u062a\u062e\u062f\u0627\u0645 \u0641\u064a \u0627\u0644\u0625\u0646\u062a\u0627\u062c\u060c \u0627\u0633\u062a\u0628\u062f\u0644 \u0646\u0637\u0627\u0642 <code>0.0.0.0\/0<\/code> \u0628\u0646\u0637\u0627\u0642\u0627\u062a IP \u0645\u062d\u062f\u0651\u062f\u0629 \u0644\u0648\u0627\u062c\u0647\u0629 API \u0627\u0644\u062e\u0627\u0635\u0629 \u0628\u0640 GitHub\u060c \u0648\u0633\u062c\u0644 \u0627\u0644\u062d\u0627\u0648\u064a\u0627\u062a \u0644\u062f\u064a\u0643\u060c \u0648\u0645\u062e\u0632\u0646 \u0627\u0644\u0640 artifacts.<\/p>\n\n<h3 class=\"wp-block-heading\">GitLab CI \u0645\u0639 \u062a\u0647\u064a\u0626\u0629 \u0627\u0644\u0640 Runner<\/h3>\n\n<p class=\"wp-block-paragraph\">\u064a\u062f\u0639\u0645 \u0645\u064f\u0646\u0641\u0650\u0651\u0630 GitLab \u0644\u0640 Kubernetes \u062a\u0647\u064a\u0626\u0629 \u0633\u064a\u0627\u0642 \u0627\u0644\u0623\u0645\u0627\u0646 \u0641\u064a \u0645\u0644\u0641 <code>config.toml<\/code> \u0627\u0644\u062e\u0627\u0635 \u0628\u0627\u0644\u0640 runner. \u0648\u064a\u0645\u0643\u0646\u0643 \u0636\u0628\u0637 \u0646\u0638\u0627\u0645 \u0627\u0644\u0645\u0644\u0641\u0627\u062a \u0644\u0644\u0642\u0631\u0627\u0621\u0629 \u0641\u0642\u0637 \u0648\u0642\u064a\u0648\u062f \u0623\u062e\u0631\u0649 \u0645\u0628\u0627\u0634\u0631\u0629\u064b:<\/p>\n\n<pre><code># config.toml for GitLab Runner (Kubernetes executor)\n[[runners]]\n  name = \"secure-k8s-runner\"\n  executor = \"kubernetes\"\n  [runners.kubernetes]\n    namespace = \"ci-runners\"\n    image = \"alpine:latest\"\n    privileged = false\n    allow_privilege_escalation = false\n    [runners.kubernetes.pod_security_context]\n      run_as_non_root = true\n      run_as_user = 1000\n    [runners.kubernetes.build_container_security_context]\n      read_only_root_filesystem = true\n      allow_privilege_escalation = false\n      [runners.kubernetes.build_container_security_context.capabilities]\n        drop = [\"ALL\"]\n    [runners.kubernetes.volumes]\n      [[runners.kubernetes.volumes.empty_dir]]\n        name = \"build-tmp\"\n        mount_path = \"\/tmp\"\n        medium = \"Memory\"\n        size_limit = \"512Mi\"\n      [[runners.kubernetes.volumes.empty_dir]]\n        name = \"build-workspace\"\n        mount_path = \"\/builds\"\n        size_limit = \"5Gi\"<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\">\u0627\u062c\u0645\u0639 \u0647\u0630\u0627 \u0645\u0639 NetworkPolicy \u0645\u0637\u0628\u064e\u0651\u0642\u0629 \u0639\u0644\u0649 \u0645\u0633\u0627\u062d\u0629 \u0627\u0644\u0623\u0633\u0645\u0627\u0621 <code>ci-runners<\/code> \u0641\u062a\u062d\u0635\u0644 \u0639\u0644\u0649 \u0642\u064a\u0648\u062f \u0644\u0646\u0638\u0627\u0645 \u0627\u0644\u0645\u0644\u0641\u0627\u062a \u0648\u0644\u0644\u0634\u0628\u0643\u0629 \u0645\u0639\u0627\u064b.<\/p>\n\n<h3 class=\"wp-block-heading\">\u0642\u064a\u0648\u062f Docker-in-Docker<\/h3>\n\n<p class=\"wp-block-paragraph\">\u064a\u064f\u0633\u062a\u062e\u062f\u064e\u0645 Docker-in-Docker (DinD) \u0639\u0627\u062f\u0629\u064b \u0644\u0628\u0646\u0627\u0621 \u0635\u0648\u0631 \u0627\u0644\u062d\u0627\u0648\u064a\u0627\u062a \u0641\u064a \u0627\u0644\u0640 CI. \u0648\u0647\u0648 \u0623\u064a\u0636\u0627\u064b \u0623\u062d\u062f \u0623\u0643\u062b\u0631 \u0627\u0644\u0623\u0646\u0645\u0627\u0637 \u062e\u0637\u0648\u0631\u0629 \u0644\u0623\u0646\u0647 \u064a\u062a\u0637\u0644\u0628 \u0639\u0627\u062f\u0629\u064b \u0627\u0644\u0648\u0636\u0639 \u0627\u0644\u0645\u0645\u064a\u0651\u0632 (privileged mode). \u0648\u0625\u0630\u0627 \u0643\u0627\u0646 \u0644\u0627 \u0628\u062f \u0645\u0646 \u0627\u0633\u062a\u062e\u062f\u0627\u0645 DinD\u060c \u0641\u0637\u0628\u0651\u0642 \u0647\u0630\u0647 \u0627\u0644\u0642\u064a\u0648\u062f:<\/p>\n\n<pre><code># Use rootless DinD instead of privileged mode\nservices:\n  dind:\n    image: docker:24-dind-rootless\n    environment:\n      - DOCKER_TLS_CERTDIR=\/certs\n    volumes:\n      - dind-certs:\/certs\/client\n      - dind-data:\/var\/lib\/docker\n\n# When running builds inside DinD, pass network and filesystem restrictions\ndocker --host tcp:\/\/dind:2376 --tlsverify \\\n  run --network=none --read-only \\\n  --tmpfs \/tmp:rw,noexec,size=256m \\\n  --security-opt=no-new-privileges \\\n  my-build-image:latest make build<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\">\u0648\u0627\u0644\u0623\u0641\u0636\u0644 \u0645\u0646 \u0630\u0644\u0643 \u0623\u0646 \u062a\u0633\u062a\u0628\u062f\u0644 \u0628\u0640 DinD \u0623\u062f\u0648\u0627\u062a \u0644\u0627 \u062a\u062d\u062a\u0627\u062c \u0625\u0644\u0649 \u062e\u0641\u064a\u0651 Docker (Docker daemon) \u0639\u0644\u0649 \u0627\u0644\u0625\u0637\u0644\u0627\u0642. \u0641\u0623\u062f\u0648\u0627\u062a \u0645\u062b\u0644 <code>kaniko<\/code> \u0648<code>buildah<\/code> \u0648<code>ko<\/code> \u064a\u0645\u0643\u0646\u0647\u0627 \u0628\u0646\u0627\u0621 \u0635\u0648\u0631 \u0627\u0644\u062d\u0627\u0648\u064a\u0627\u062a \u062f\u0648\u0646 \u0648\u0635\u0648\u0644 \u0645\u0645\u064a\u0651\u0632\u060c \u0648\u062a\u0639\u0645\u0644 \u062c\u064a\u062f\u0627\u064b \u0645\u0639 \u0623\u0646\u0638\u0645\u0629 \u0627\u0644\u0645\u0644\u0641\u0627\u062a \u0644\u0644\u0642\u0631\u0627\u0621\u0629 \u0641\u0642\u0637 \u0648\u0627\u0644\u0634\u0628\u0643\u0627\u062a \u0627\u0644\u0645\u0642\u064a\u0651\u062f\u0629.<\/p>\n\n<h2 class=\"wp-block-heading\">\u0627\u0644\u0645\u0631\u0627\u0642\u0628\u0629 \u0648\u0627\u0644\u062a\u062f\u0642\u064a\u0642<\/h2>\n\n<p class=\"wp-block-paragraph\">\u0627\u0644\u0642\u064a\u0648\u062f \u0645\u0641\u064a\u062f\u0629 \u0641\u0642\u0637 \u0625\u0630\u0627 \u0643\u0646\u062a \u062a\u0639\u0631\u0641 \u0645\u062a\u0649 \u064a\u062c\u0631\u064a \u0627\u062e\u062a\u0628\u0627\u0631\u0647\u0627 \u0623\u0648 \u062a\u062c\u0627\u0648\u0632\u0647\u0627. \u0641\u0627\u0644\u0645\u0631\u0627\u0642\u0628\u0629 \u062a\u064f\u0643\u0645\u0644 \u0627\u0644\u0635\u0648\u0631\u0629 \u0627\u0644\u0623\u0645\u0646\u064a\u0629.<\/p>\n\n<h3 class=\"wp-block-heading\">\u0643\u0634\u0641 \u0627\u0644\u0627\u062a\u0635\u0627\u0644\u0627\u062a \u0627\u0644\u0634\u0628\u0643\u064a\u0629 \u063a\u064a\u0631 \u0627\u0644\u0645\u062a\u0648\u0642\u0639\u0629<\/h3>\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a\u062e\u062f\u0645 Hubble \u0645\u0646 Cilium\u060c \u0623\u0648 \u0633\u062c\u0644\u0627\u062a \u0627\u0644\u062a\u062f\u0641\u0642 (flow logs) \u0645\u0646 Calico\u060c \u0623\u0648 Falco \u0644\u0643\u0634\u0641 \u0627\u0644\u0627\u062a\u0635\u0627\u0644\u0627\u062a \u0627\u0644\u0634\u0628\u0643\u064a\u0629 \u0627\u0644\u062a\u064a \u0643\u0627\u0646 \u064a\u0646\u0628\u063a\u064a \u0644\u0633\u064a\u0627\u0633\u062a\u0643 \u062d\u062c\u0628\u0647\u0627 (\u0623\u0648 \u0627\u0644\u0627\u062a\u0635\u0627\u0644\u0627\u062a \u0628\u0648\u062c\u0647\u0627\u062a \u063a\u064a\u0631 \u0645\u0639\u062a\u0627\u062f\u0629 \u0639\u0644\u0649 \u0627\u0644\u0645\u0646\u0627\u0641\u0630 \u0627\u0644\u0645\u0633\u0645\u0648\u062d \u0628\u0647\u0627). \u0623\u0639\u062f\u0651 \u062a\u0646\u0628\u064a\u0647\u0627\u062a \u0644\u0623\u064a \u0627\u0633\u062a\u0639\u0644\u0627\u0645\u0627\u062a DNS \u0625\u0644\u0649 \u0646\u0637\u0627\u0642\u0627\u062a \u0644\u064a\u0633\u062a \u0641\u064a \u0642\u0627\u0626\u0645\u0629 \u0627\u0644\u0633\u0645\u0627\u062d \u0644\u062f\u064a\u0643\u060c \u0648\u0627\u0644\u0627\u062a\u0635\u0627\u0644\u0627\u062a \u0627\u0644\u0635\u0627\u062f\u0631\u0629 \u0625\u0644\u0649 \u0645\u0646\u0627\u0641\u0630 \u063a\u064a\u0631 \u0642\u064a\u0627\u0633\u064a\u0629\u060c \u0648\u0627\u0644\u0627\u062a\u0635\u0627\u0644\u0627\u062a \u0628\u0646\u0637\u0627\u0642\u0627\u062a IP \u0645\u0639\u0631\u0648\u0641\u0629 \u0628\u062e\u0628\u062b\u0647\u0627\u060c \u0648\u0623\u064a \u062d\u0631\u0643\u0629 \u0635\u0627\u062f\u0631\u0629 \u0645\u0646 \u0628\u0648\u062f\u0627\u062a \u064a\u0646\u0628\u063a\u064a \u0623\u0646 \u062a\u0643\u0648\u0646 \u0628\u0640 <code>--network=none<\/code>.<\/p>\n\n<pre><code># Falco rule: detect unexpected outbound connections from CI runners\n- rule: CI Runner Unexpected Outbound Connection\n  desc: Detect network connections from CI runner pods to non-approved destinations\n  condition: >\n    evt.type in (connect, sendto) and\n    container and\n    k8s.ns.name = \"ci-runners\" and\n    not (fd.sip in (approved_registry_ips) or fd.sport = 53)\n  output: >\n    Unexpected outbound connection from CI runner\n    (command=%proc.cmdline connection=%fd.name container=%container.name\n    pod=%k8s.pod.name namespace=%k8s.ns.name)\n  priority: WARNING\n  tags: [network, ci-cd, supply-chain]<\/code><\/pre>\n\n<h3 class=\"wp-block-heading\">\u062a\u062f\u0642\u064a\u0642 \u0627\u0644\u0648\u0635\u0648\u0644 \u0625\u0644\u0649 \u0646\u0638\u0627\u0645 \u0627\u0644\u0645\u0644\u0641\u0627\u062a<\/h3>\n\n<p class=\"wp-block-paragraph\">\u0631\u0627\u0642\u0628 \u0639\u0645\u0644\u064a\u0627\u062a \u0627\u0644\u0643\u062a\u0627\u0628\u0629 \u0641\u064a \u0646\u0638\u0627\u0645 \u0627\u0644\u0645\u0644\u0641\u0627\u062a \u062f\u0627\u062e\u0644 \u062d\u0627\u0648\u064a\u0627\u062a \u0627\u0644\u0640 build \u0644\u0643\u0634\u0641 \u0627\u0644\u062a\u0639\u062f\u064a\u0644\u0627\u062a \u063a\u064a\u0631 \u0627\u0644\u0645\u062a\u0648\u0642\u0639\u0629. \u0641\u0628\u0625\u0645\u0643\u0627\u0646 <code>auditd<\/code> \u0641\u064a Linux \u0645\u0631\u0627\u0642\u0628\u0629 \u0645\u0633\u0627\u0631\u0627\u062a \u0645\u062d\u062f\u0651\u062f\u0629\u060c \u0648\u0628\u0625\u0645\u0643\u0627\u0646 Falco \u0643\u0634\u0641 \u0627\u0644\u0643\u062a\u0627\u0628\u0629 \u0641\u064a \u0627\u0644\u0645\u0648\u0627\u0636\u0639 \u0627\u0644\u062d\u0633\u0627\u0633\u0629. \u0648\u062a\u0634\u0645\u0644 \u0627\u0644\u0645\u0633\u0627\u0631\u0627\u062a \u0627\u0644\u0631\u0626\u064a\u0633\u064a\u0629 \u0627\u0644\u0648\u0627\u062c\u0628 \u0645\u0631\u0627\u0642\u0628\u062a\u0647\u0627 <code>\/etc<\/code> \u0648<code>\/usr<\/code> (\u0644\u0627 \u064a\u0646\u0628\u063a\u064a \u0627\u0644\u0643\u062a\u0627\u0628\u0629 \u0641\u064a\u0647\u0645\u0627 \u0623\u0628\u062f\u0627\u064b \u0623\u062b\u0646\u0627\u0621 build)\u060c \u0648\u0645\u0633\u0627\u0631 \u0645\u0642\u0628\u0633 Docker\u060c \u0648\u0645\u0633\u0627\u0631\u0627\u062a \u0631\u0645\u0648\u0632 \u062d\u0633\u0627\u0628\u0627\u062a \u062e\u062f\u0645\u0629 Kubernetes\u060c \u0648\u0623\u064a \u0645\u0633\u0627\u0631 \u064a\u062d\u062a\u0648\u064a \u0639\u0644\u0649 \u0628\u064a\u0627\u0646\u0627\u062a \u0627\u0639\u062a\u0645\u0627\u062f \u0623\u0648 \u0645\u0641\u0627\u062a\u064a\u062d \u062a\u0648\u0642\u064a\u0639.<\/p>\n\n<p class=\"wp-block-paragraph\">\u0625\u0630\u0627 \u0643\u0646\u062a \u062a\u0633\u062a\u062e\u062f\u0645 \u0623\u0646\u0638\u0645\u0629 \u0645\u0644\u0641\u0627\u062a \u062c\u0630\u0631\u064a\u0629 \u0644\u0644\u0642\u0631\u0627\u0621\u0629 \u0641\u0642\u0637\u060c \u0641\u0625\u0646 \u0623\u064a \u0645\u062d\u0627\u0648\u0644\u0629 \u0643\u062a\u0627\u0628\u0629 \u0641\u064a \u0645\u0633\u0627\u0631 \u0645\u062d\u0645\u064a \u062a\u0648\u0644\u0651\u062f \u062e\u0637\u0623\u064b \u2014 \u0633\u062c\u0651\u0644 \u0647\u0630\u0647 \u0627\u0644\u0623\u062e\u0637\u0627\u0621 \u0648\u0646\u0628\u0651\u0647 \u0639\u0644\u064a\u0647\u0627. \u0641\u0647\u064a \u062a\u0634\u064a\u0631 \u0625\u0645\u0627 \u0625\u0644\u0649 build \u0633\u064a\u0651\u0626 \u0627\u0644\u062a\u0647\u064a\u0626\u0629 \u0623\u0648 \u0625\u0644\u0649 \u0647\u062c\u0648\u0645 \u0645\u062d\u062a\u0645\u0644.<\/p>\n\n<h2 class=\"wp-block-heading\">\u0627\u0644\u0645\u0641\u0627\u0636\u0644\u0627\u062a \u0648\u062a\u062c\u0631\u0628\u0629 \u0627\u0644\u0645\u0637\u0648\u0651\u0631<\/h2>\n\n<p class=\"wp-block-paragraph\">\u0627\u0644\u0642\u064a\u0648\u062f \u0627\u0644\u0635\u0627\u0631\u0645\u0629 \u0639\u0644\u0649 \u0627\u0644\u0634\u0628\u0643\u0629 \u0648\u0646\u0638\u0627\u0645 \u0627\u0644\u0645\u0644\u0641\u0627\u062a \u062a\u062e\u0644\u0642 \u0627\u062d\u062a\u0643\u0627\u0643\u0627\u064b \u0644\u0627 \u0645\u062d\u0627\u0644\u0629. \u0648\u0641\u0647\u0645 \u0647\u0630\u0647 \u0627\u0644\u0645\u0641\u0627\u0636\u0644\u0627\u062a \u0648\u0625\u062f\u0627\u0631\u062a\u0647\u0627 \u0623\u0645\u0631 \u062c\u0648\u0647\u0631\u064a \u0644\u0646\u062c\u0627\u062d \u0627\u0644\u062a\u0628\u0646\u0651\u064a.<\/p>\n\n<h3 class=\"wp-block-heading\">\u0633\u0631\u0639\u0629 \u0627\u0644\u0640 build<\/h3>\n\n<p class=\"wp-block-paragraph\">\u062a\u062a\u0637\u0644\u0628 \u0639\u0645\u0644\u064a\u0627\u062a \u0627\u0644\u0640 build \u0627\u0644\u0645\u064f\u062d\u0643\u064e\u0645\u0629 \u062c\u0644\u0628 \u062c\u0645\u064a\u0639 \u0627\u0644\u062a\u0628\u0639\u064a\u0627\u062a \u0645\u0633\u0628\u0642\u0627\u064b\u060c \u0645\u0627 \u064a\u0636\u064a\u0641 \u0645\u0631\u062d\u0644\u0629 \u0625\u0644\u0649 \u062e\u0637 \u0627\u0644\u0623\u0646\u0627\u0628\u064a\u0628. \u0644\u0643\u0646 \u0647\u0630\u0627 \u064a\u0639\u0646\u064a \u0623\u064a\u0636\u0627\u064b \u0625\u0645\u0643\u0627\u0646\u064a\u0629 \u062a\u062e\u0632\u064a\u0646 \u0627\u0644\u062a\u0628\u0639\u064a\u0627\u062a \u0645\u0624\u0642\u062a\u0627\u064b \u0628\u0642\u0648\u0629. \u0648\u0639\u0645\u0644\u064a\u0627\u064b\u060c \u062a\u062c\u062f \u0641\u0631\u0642 \u0643\u062b\u064a\u0631\u0629 \u0623\u0646 \u0639\u0645\u0644\u064a\u0627\u062a \u0627\u0644\u0640 build \u0627\u0644\u0645\u064f\u062d\u0643\u064e\u0645\u0629 \u0623\u0633\u0631\u0639 \u0641\u0639\u0644\u0627\u064b\u060c \u0644\u0623\u0646 \u0645\u0639\u062f\u0651\u0644 \u0625\u0635\u0627\u0628\u0629 \u0630\u0627\u0643\u0631\u0629 \u0627\u0644\u062a\u062e\u0632\u064a\u0646 \u0627\u0644\u0645\u0624\u0642\u062a \u0623\u0639\u0644\u0649 \u0628\u0643\u062b\u064a\u0631 \u062d\u064a\u0646 \u064a\u0643\u0648\u0646 \u062a\u062d\u0644\u064a\u0644 \u0627\u0644\u062a\u0628\u0639\u064a\u0627\u062a \u062d\u062a\u0645\u064a\u0627\u064b. \u0627\u0633\u062a\u062e\u062f\u0645 \u0630\u0627\u0643\u0631\u0629 \u062a\u062e\u0632\u064a\u0646 \u0645\u0624\u0642\u062a \u0645\u0634\u062a\u0631\u0643\u0629 (\u0630\u0627\u0643\u0631\u0629 Bazel \u0627\u0644\u0628\u0639\u064a\u062f\u0629\u060c \u0623\u0648 \u0630\u0627\u0643\u0631\u0629 Nix \u0627\u0644\u062b\u0646\u0627\u0626\u064a\u0629\u060c \u0623\u0648 \u0630\u0627\u0643\u0631\u0629 HTTP \u0628\u0633\u064a\u0637\u0629 \u0644\u0644\u062a\u0628\u0639\u064a\u0627\u062a \u0627\u0644\u0645\u064f\u0648\u0631\u064e\u0651\u062f\u0629) \u0644\u062a\u0648\u0632\u064a\u0639 \u0627\u0644\u062a\u0643\u0644\u0641\u0629 \u0639\u0644\u0649 \u0639\u0645\u0644\u064a\u0627\u062a \u0627\u0644\u0640 build.<\/p>\n\n<h3 class=\"wp-block-heading\">\u062a\u062c\u0631\u0628\u0629 \u0627\u0644\u0645\u0637\u0648\u0651\u0631<\/h3>\n\n<p class=\"wp-block-paragraph\">\u0633\u064a\u0648\u0627\u062c\u0647 \u0627\u0644\u0645\u0637\u0648\u0651\u0631\u0648\u0646 \u0625\u062e\u0641\u0627\u0642\u0627\u062a \u062d\u064a\u0646 \u062a\u062d\u0627\u0648\u0644 \u0639\u0645\u0644\u064a\u0627\u062a \u0627\u0644\u0640 build \u0627\u0644\u0648\u0635\u0648\u0644 \u0625\u0644\u0649 \u0646\u0642\u0627\u0637 \u0646\u0647\u0627\u064a\u0629 \u0634\u0628\u0643\u064a\u0629 \u0645\u062d\u062c\u0648\u0628\u0629 \u0623\u0648 \u0627\u0644\u0643\u062a\u0627\u0628\u0629 \u0641\u064a \u0645\u0633\u0627\u0631\u0627\u062a \u0644\u0644\u0642\u0631\u0627\u0621\u0629 \u0641\u0642\u0637. \u0648\u0631\u0633\u0627\u0626\u0644 \u0627\u0644\u062e\u0637\u0623 \u0627\u0644\u062c\u064a\u062f\u0629 \u0636\u0631\u0648\u0631\u064a\u0629. \u063a\u0644\u0651\u0641 \u062e\u0637\u0648\u0627\u062a \u0627\u0644\u0640 build \u0644\u062f\u064a\u0643 \u0628\u0633\u0643\u0631\u0628\u062a\u0627\u062a \u062a\u0644\u062a\u0642\u0637 \u0623\u062e\u0637\u0627\u0621 \u0627\u0644\u0623\u0630\u0648\u0646\u0627\u062a \u0648\u0627\u0644\u0625\u062e\u0641\u0627\u0642\u0627\u062a \u0627\u0644\u0634\u0628\u0643\u064a\u0629\u060c \u062b\u0645 \u062a\u064f\u062e\u0631\u062c \u0631\u0633\u0627\u0626\u0644 \u0642\u0627\u0628\u0644\u0629 \u0644\u0644\u062a\u0646\u0641\u064a\u0630 \u062a\u0648\u0636\u0651\u062d \u0633\u0628\u0628 \u062d\u062c\u0628 \u0627\u0644\u0648\u0635\u0648\u0644 \u0648\u0643\u064a\u0641\u064a\u0629 \u0625\u0635\u0644\u0627\u062d \u0627\u0644\u0645\u0634\u0643\u0644\u0629 (\u0639\u0627\u062f\u0629\u064b \u0628\u0625\u0636\u0627\u0641\u0629 \u062a\u0628\u0639\u064a\u0629 \u0625\u0644\u0649 \u0645\u0644\u0641 \u0627\u0644\u0642\u0641\u0644 \u0623\u0648 \u0628\u062a\u063a\u064a\u064a\u0631 \u0645\u0633\u0627\u0631 \u0627\u0644\u0645\u062e\u0631\u062c\u0627\u062a).<\/p>\n\n<p class=\"wp-block-paragraph\">\u0641\u0643\u0651\u0631 \u0641\u064a \u062a\u0646\u0641\u064a\u0630 \u0637\u0631\u062d \u062a\u062f\u0631\u064a\u062c\u064a: \u0627\u0628\u062f\u0623 \u0628\u0648\u0636\u0639 \u0627\u0644\u0645\u0631\u0627\u0642\u0628\u0629 (\u0633\u062c\u0651\u0644 \u0627\u0644\u0645\u062e\u0627\u0644\u0641\u0627\u062a \u062f\u0648\u0646 \u062d\u062c\u0628\u0647\u0627)\u060c \u062b\u0645 \u0627\u0646\u062a\u0642\u0644 \u0625\u0644\u0649 \u0627\u0644\u0641\u0631\u0636. \u0641\u0647\u0630\u0627 \u064a\u0645\u0646\u062d \u0627\u0644\u0641\u0631\u0642 \u0648\u0642\u062a\u0627\u064b \u0644\u062a\u062d\u062f\u064a\u062b \u062a\u0647\u064a\u0626\u0627\u062a \u0627\u0644\u0640 build \u0644\u062f\u064a\u0647\u0627 \u062f\u0648\u0646 \u0643\u0633\u0631 \u0643\u0644 \u062e\u0637 \u0623\u0646\u0627\u0628\u064a\u0628 \u062f\u0641\u0639\u0629\u064b \u0648\u0627\u062d\u062f\u0629.<\/p>\n\n<h3 class=\"wp-block-heading\">\u062a\u0635\u062d\u064a\u062d \u0627\u0644\u0623\u062e\u0637\u0627\u0621<\/h3>\n\n<p class=\"wp-block-paragraph\">\u064a\u0643\u0648\u0646 \u062a\u0635\u062d\u064a\u062d \u0625\u062e\u0641\u0627\u0642\u0627\u062a \u0627\u0644\u0640 build \u0641\u064a \u0628\u064a\u0626\u0629 \u0645\u0642\u064a\u0651\u062f\u0629 \u0623\u0635\u0639\u0628 \u062d\u064a\u0646 \u0644\u0627 \u062a\u0633\u062a\u0637\u064a\u0639 \u062a\u062b\u0628\u064a\u062a \u0623\u062f\u0648\u0627\u062a \u0625\u0636\u0627\u0641\u064a\u0629 \u0623\u0648 \u0627\u0644\u0648\u0635\u0648\u0644 \u0625\u0644\u0649 \u062e\u062f\u0645\u0627\u062a \u062e\u0627\u0631\u062c\u064a\u0629. \u0648\u0641\u0651\u0631 &#8220;\u0648\u0636\u0639 \u062a\u0635\u062d\u064a\u062d&#8221; (debug mode) \u064a\u062e\u0641\u0651\u0641 \u0627\u0644\u0642\u064a\u0648\u062f \u0644\u062a\u0634\u063a\u064a\u0644 \u062e\u0637 \u0623\u0646\u0627\u0628\u064a\u0628 \u0645\u062d\u062f\u0651\u062f \u064a\u064f\u0637\u0644\u064e\u0642 \u064a\u062f\u0648\u064a\u0627\u064b (\u0648\u0644\u064a\u0633 \u0623\u0628\u062f\u0627\u064b \u0644\u0639\u0645\u0644\u064a\u0627\u062a \u0627\u0644\u062a\u0634\u063a\u064a\u0644 \u0627\u0644\u0622\u0644\u064a\u0629 \u0639\u0644\u0649 \u0627\u0644\u0641\u0631\u0639 \u0627\u0644\u0631\u0626\u064a\u0633\u064a). \u0633\u062c\u0651\u0644 \u0623\u0646 \u0648\u0636\u0639 \u0627\u0644\u062a\u0635\u062d\u064a\u062d \u0642\u062f \u0627\u0633\u062a\u064f\u062e\u062f\u0645 \u0648\u0645\u064e\u0646 \u0623\u0637\u0644\u0642\u0647. \u0648\u0644\u0627 \u062a\u0633\u0645\u062d \u0623\u0628\u062f\u0627\u064b \u0644\u0648\u0636\u0639 \u0627\u0644\u062a\u0635\u062d\u064a\u062d \u0628\u062a\u062c\u0627\u0648\u0632 \u0627\u0644\u0642\u064a\u0648\u062f \u0639\u0644\u0649 \u0639\u0645\u0644\u064a\u0627\u062a build \u0627\u0644\u062e\u0627\u0635\u0629 \u0628\u0640 artifacts \u0627\u0644\u0625\u0646\u062a\u0627\u062c.<\/p>\n\n<h2 class=\"wp-block-heading\">\u0627\u0644\u062c\u0645\u0639 \u0628\u064a\u0646 \u0643\u0644 \u0630\u0644\u0643<\/h2>\n\n<p class=\"wp-block-paragraph\">\u0641\u064a\u0645\u0627 \u064a\u0644\u064a \u0645\u0644\u062e\u0651\u0635 \u0644\u0644\u0646\u0647\u062c \u0627\u0644\u0637\u0628\u0642\u064a \u0644\u062a\u0623\u0645\u064a\u0646 \u0628\u064a\u0626\u0627\u062a build \u0627\u0644\u062e\u0627\u0635\u0629 \u0628\u0640 CI\/CD:<\/p>\n\n<p class=\"wp-block-paragraph\"><strong>\u0627\u0644\u0637\u0628\u0642\u0629 1 \u2014 \u0627\u0644\u0642\u064a\u0648\u062f \u0627\u0644\u0634\u0628\u0643\u064a\u0629:<\/strong> \u0627\u0645\u0646\u0639 \u0627\u0644\u062d\u0631\u0643\u0629 \u0627\u0644\u0635\u0627\u062f\u0631\u0629 \u0627\u0641\u062a\u0631\u0627\u0636\u064a\u0627\u064b \u0645\u0639 \u0642\u0648\u0627\u0626\u0645 \u0633\u0645\u0627\u062d \u0644\u0644\u0633\u062c\u0644\u0627\u062a \u0648\u0648\u0627\u062c\u0647\u0627\u062a API. \u0627\u0633\u062a\u062e\u062f\u0645 NetworkPolicy \u0641\u064a Kubernetes\u060c \u0623\u0648 <code>--network=none<\/code> \u0641\u064a Docker\u060c \u0623\u0648 \u0642\u0648\u0627\u0639\u062f \u062c\u062f\u0627\u0631 \u0627\u0644\u062d\u0645\u0627\u064a\u0629 \u0639\u0644\u0649 \u0645\u0633\u062a\u0648\u0649 \u0627\u0644\u0645\u0636\u064a\u0641 \u0628\u062d\u0633\u0628 \u0628\u0646\u064a\u0629 \u0627\u0644\u0640 runner \u0644\u062f\u064a\u0643.<\/p>\n\n<p class=\"wp-block-paragraph\"><strong>\u0627\u0644\u0637\u0628\u0642\u0629 2 \u2014 \u0642\u064a\u0648\u062f \u0646\u0638\u0627\u0645 \u0627\u0644\u0645\u0644\u0641\u0627\u062a:<\/strong> \u0646\u0638\u0627\u0645 \u0645\u0644\u0641\u0627\u062a \u062c\u0630\u0631\u064a \u0644\u0644\u0642\u0631\u0627\u0621\u0629 \u0641\u0642\u0637\u060c \u0648tmpfs \u0644\u0644\u0645\u0633\u0627\u0631\u0627\u062a \u0627\u0644\u0642\u0627\u0628\u0644\u0629 \u0644\u0644\u0643\u062a\u0627\u0628\u0629 \u0628\u062d\u062f\u0648\u062f \u062d\u062c\u0645 \u0648\u0628\u062e\u064a\u0627\u0631 noexec\u060c \u0648\u0634\u064a\u0641\u0631\u0629 \u0645\u0635\u062f\u0631\u064a\u0629 \u0645\u064f\u0631\u0643\u064e\u0651\u0628\u0629 \u0644\u0644\u0642\u0631\u0627\u0621\u0629 \u0641\u0642\u0637.<\/p>\n\n<p class=\"wp-block-paragraph\"><strong>\u0627\u0644\u0637\u0628\u0642\u0629 3 \u2014 \u0639\u0645\u0644\u064a\u0627\u062a \u0627\u0644\u0640 build \u0627\u0644\u0645\u064f\u062d\u0643\u064e\u0645\u0629:<\/strong> \u0627\u0641\u0635\u0650\u0644 \u062a\u062d\u0644\u064a\u0644 \u0627\u0644\u062a\u0628\u0639\u064a\u0627\u062a \u0639\u0646 \u0627\u0644\u0640 build. \u0648\u0634\u063a\u0651\u0644 \u0645\u0631\u062d\u0644\u0629 \u0627\u0644\u0640 build \u0628\u0648\u0635\u0648\u0644 \u0634\u0628\u0643\u064a \u0635\u0641\u0631\u064a \u0648\u0628\u0645\u062f\u062e\u0644\u0627\u062a \u0645\u064f\u062c\u0644\u0648\u0628\u0629 \u0645\u0633\u0628\u0642\u0627\u064b \u0648\u0645\u064f\u062a\u062d\u0642\u064e\u0651\u0642 \u0645\u0646 \u062a\u062c\u0632\u0626\u062a\u0647\u0627 \u0641\u0642\u0637.<\/p>\n\n<p class=\"wp-block-paragraph\"><strong>\u0627\u0644\u0637\u0628\u0642\u0629 4 \u2014 \u0627\u0644\u0645\u0631\u0627\u0642\u0628\u0629:<\/strong> \u0627\u0643\u0634\u0641 \u0645\u062e\u0627\u0644\u0641\u0627\u062a \u0627\u0644\u0633\u064a\u0627\u0633\u0629 \u0648\u0627\u0644\u0627\u062a\u0635\u0627\u0644\u0627\u062a \u063a\u064a\u0631 \u0627\u0644\u0645\u062a\u0648\u0642\u0639\u0629 \u0648\u0645\u062d\u0627\u0648\u0644\u0627\u062a \u062a\u0639\u062f\u064a\u0644 \u0646\u0638\u0627\u0645 \u0627\u0644\u0645\u0644\u0641\u0627\u062a \u0648\u0646\u0628\u0651\u0647 \u0639\u0644\u064a\u0647\u0627.<\/p>\n\n<p class=\"wp-block-paragraph\">\u0644\u0627 \u062a\u0643\u0641\u064a \u0623\u064a \u0637\u0628\u0642\u0629 \u0648\u062d\u062f\u0647\u0627. \u0641\u0627\u0644\u0642\u064a\u0648\u062f \u0627\u0644\u0634\u0628\u0643\u064a\u0629 \u0628\u0644\u0627 \u0636\u0648\u0627\u0628\u0637 \u0644\u0646\u0638\u0627\u0645 \u0627\u0644\u0645\u0644\u0641\u0627\u062a \u0644\u0627 \u062a\u0632\u0627\u0644 \u062a\u062a\u064a\u062d \u0627\u0644\u0639\u0628\u062b \u0628\u0627\u0644\u0640 artifacts. \u0648\u0642\u064a\u0648\u062f \u0646\u0638\u0627\u0645 \u0627\u0644\u0645\u0644\u0641\u0627\u062a \u0628\u0644\u0627 \u0636\u0648\u0627\u0628\u0637 \u0634\u0628\u0643\u064a\u0629 \u0644\u0627 \u062a\u0632\u0627\u0644 \u062a\u062a\u064a\u062d \u0627\u0644\u062a\u0633\u0631\u064a\u0628. \u0648\u0639\u0645\u0644\u064a\u0627\u062a \u0627\u0644\u0640 build \u0627\u0644\u0645\u064f\u062d\u0643\u064e\u0645\u0629 \u0628\u0644\u0627 \u0645\u0631\u0627\u0642\u0628\u0629 \u062a\u062a\u0631\u0643\u0643 \u0623\u0639\u0645\u0649 \u0639\u0646 \u0645\u062d\u0627\u0648\u0644\u0627\u062a \u0627\u0644\u0647\u062c\u0648\u0645. \u0641\u0627\u0644\u0637\u0628\u0642\u0627\u062a \u064a\u0639\u0632\u0651\u0632 \u0628\u0639\u0636\u0647\u0627 \u0628\u0639\u0636\u0627\u064b.<\/p>\n\n<h2 class=\"wp-block-heading\">\u0623\u062f\u0644\u0629 \u0630\u0627\u062a \u0635\u0644\u0629<\/h2>\n\n<p class=\"wp-block-paragraph\">\u0644\u0645\u0632\u064a\u062f \u062d\u0648\u0644 \u062a\u0623\u0645\u064a\u0646 \u062e\u0637 \u0623\u0646\u0627\u0628\u064a\u0628 CI\/CD \u0644\u062f\u064a\u0643\u060c \u0631\u0627\u062c\u0639 \u0647\u0630\u0647 \u0627\u0644\u0623\u062f\u0644\u0629 \u0630\u0627\u062a \u0627\u0644\u0635\u0644\u0629:<\/p>\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/secure-pipelines.com\/ar\/ci-cd-security\/build-integrity-reproducible-builds-ci-cd\/\">\u0633\u0644\u0627\u0645\u0629 \u0627\u0644\u0640 build \u0648\u0639\u0645\u0644\u064a\u0627\u062a \u0627\u0644\u0640 build \u0627\u0644\u0642\u0627\u0628\u0644\u0629 \u0644\u0625\u0639\u0627\u062f\u0629 \u0627\u0644\u0625\u0646\u062a\u0627\u062c \u0641\u064a CI\/CD<\/a> \u2014 \u064a\u063a\u0637\u0651\u064a \u0627\u0644\u0627\u0645\u062a\u062b\u0627\u0644 \u0644\u0640 SLSA\u060c \u0648\u0627\u0644\u062a\u062d\u0642\u0642 \u0645\u0646 \u0639\u0645\u0644\u064a\u0627\u062a \u0627\u0644\u0640 build \u0627\u0644\u0642\u0627\u0628\u0644\u0629 \u0644\u0625\u0639\u0627\u062f\u0629 \u0627\u0644\u0625\u0646\u062a\u0627\u062c\u060c \u0648\u0625\u062b\u0628\u0627\u062a \u0645\u0646\u0634\u0623 \u0627\u0644\u0640 artifacts.<\/li>\n\n\n\n<li><a href=\"https:\/\/secure-pipelines.com\/ar\/ci-cd-security\/lab-ephemeral-self-hosted-runners-actions-runner-controller\/\">\u0645\u062e\u062a\u0628\u0631: runners \u0630\u0627\u062a\u064a\u0629 \u0627\u0644\u0627\u0633\u062a\u0636\u0627\u0641\u0629 \u0645\u0624\u0642\u062a\u0629 \u0645\u0639 Actions Runner Controller<\/a> \u2014 \u062f\u0644\u064a\u0644 \u0639\u0645\u0644\u064a \u0644\u0646\u0634\u0631 ARC \u0639\u0644\u0649 Kubernetes \u0628\u0628\u0648\u062f\u0627\u062a runner \u0645\u0624\u0642\u062a\u0629 \u0648\u062d\u064a\u062f\u0629 \u0627\u0644\u0627\u0633\u062a\u062e\u062f\u0627\u0645.<\/li>\n<\/ul>\n\n<p class=\"wp-block-paragraph\">\u0627\u0628\u062f\u0623 \u0628\u0627\u0644\u0642\u064a\u0648\u062f \u0627\u0644\u0634\u0628\u0643\u064a\u0629 \u2014 \u0641\u0647\u064a \u062a\u0642\u062f\u0651\u0645 \u0623\u0639\u0644\u0649 \u062a\u0623\u062b\u064a\u0631 \u0628\u0623\u0642\u0644 \u062c\u0647\u062f \u062a\u0646\u0641\u064a\u0630. \u062b\u0645 \u0623\u0636\u0641 \u0642\u064a\u0648\u062f \u0646\u0638\u0627\u0645 \u0627\u0644\u0645\u0644\u0641\u0627\u062a \u0648\u0627\u0639\u0645\u0644 \u0628\u0627\u062a\u062c\u0627\u0647 \u0639\u0645\u0644\u064a\u0627\u062a \u0627\u0644\u0640 build \u0627\u0644\u0645\u064f\u062d\u0643\u064e\u0645\u0629 \u0643\u0644\u0645\u0627 \u0632\u0627\u062f \u0646\u0636\u062c \u062e\u0637 \u0623\u0646\u0627\u0628\u064a\u0628\u0643. \u0641\u0643\u0644 \u0637\u0628\u0642\u0629 \u062a\u0636\u064a\u0641\u0647\u0627 \u062a\u062c\u0639\u0644 \u0647\u062c\u0645\u0627\u062a \u0633\u0644\u0633\u0644\u0629 \u0627\u0644\u062a\u0648\u0631\u064a\u062f \u0623\u0635\u0639\u0628 \u062a\u0646\u0641\u064a\u0630\u0627\u064b \u0639\u0644\u0649 \u0646\u062d\u0648 \u0645\u0644\u0645\u0648\u0633.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u062a\u064f\u0639\u062f \u062e\u0637\u0648\u0637 \u0623\u0646\u0627\u0628\u064a\u0628 CI\/CD \u0645\u0646 \u0623\u0643\u062b\u0631 \u0627\u0644\u0623\u062d\u0645\u0627\u0644 \u0627\u0645\u062a\u064a\u0627\u0632\u0627\u064b \u0641\u064a \u0623\u064a \u0645\u0624\u0633\u0633\u0629. \u0641\u0647\u064a \u062a\u0633\u062d\u0628 \u0627\u0644\u0634\u064a\u0641\u0631\u0629 \u0627\u0644\u0645\u0635\u062f\u0631\u064a\u0629\u060c \u0648\u062a\u0646\u0632\u0651\u0644 \u0627\u0644\u062a\u0628\u0639\u064a\u0627\u062a\u060c \u0648\u062a\u0635\u0644 \u0625\u0644\u0649 \u0627\u0644\u0623\u0633\u0631\u0627\u0631\u060c \u0648\u062a\u062f\u0641\u0639 \u0627\u0644\u0640 artifacts \u0625\u0644\u0649 \u0633\u062c\u0644\u0627\u062a \u0627\u0644\u0625\u0646\u062a\u0627\u062c. \u0648\u0645\u0639 \u0630\u0644\u0643\u060c \u0641\u064a \u0643\u062b\u064a\u0631 \u0645\u0646 \u0627\u0644\u0628\u064a\u0626\u0627\u062a\u060c \u062a\u0639\u0645\u0644 \u0639\u0645\u0644\u064a\u0627\u062a \u0627\u0644\u0640 build \u0627\u0644\u0642\u0627\u0626\u0645\u0629 \u062e\u0644\u0641 \u0647\u0630\u0647 \u0627\u0644\u062e\u0637\u0648\u0637 \u0628\u0648\u0635\u0648\u0644 \u0634\u0628\u0643\u064a \u063a\u064a\u0631 \u0645\u0642\u064a\u0651\u062f \u0648\u0623\u0630\u0648\u0646\u0627\u062a \u0643\u0627\u0645\u0644\u0629 \u0639\u0644\u0649 \u0646\u0638\u0627\u0645 \u0627\u0644\u0645\u0644\u0641\u0627\u062a \u2014 \u0648\u0647\u0648 \u0645\u0632\u064a\u062c \u064a\u0645\u062b\u0651\u0644 \u0648\u0627\u062d\u062f\u0629 \u0645\u0646 &#8230; <a title=\"\u0642\u064a\u0648\u062f \u0627\u0644\u0634\u0628\u0643\u0629 \u0648\u0646\u0638\u0627\u0645 \u0627\u0644\u0645\u0644\u0641\u0627\u062a \u0644\u0628\u064a\u0626\u0627\u062a \u0628\u0646\u0627\u0621 CI\/CD\" class=\"read-more\" href=\"https:\/\/secure-pipelines.com\/ar\/ci-cd-security\/network-filesystem-restrictions-ci-cd-build-environments\/\" aria-label=\"Read more about \u0642\u064a\u0648\u062f \u0627\u0644\u0634\u0628\u0643\u0629 \u0648\u0646\u0638\u0627\u0645 \u0627\u0644\u0645\u0644\u0641\u0627\u062a \u0644\u0628\u064a\u0626\u0627\u062a \u0628\u0646\u0627\u0621 CI\/CD\">\u0627\u0642\u0631\u0623 \u0627\u0644\u0645\u0632\u064a\u062f<\/a><\/p>\n","protected":false},"author":1,"featured_media":1564,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26,66,28,63],"tags":[],"post_folder":[],"class_list":["post-788","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ci-cd-security","category-pipeline-hardening"],"_links":{"self":[{"href":"https:\/\/secure-pipelines.com\/ar\/wp-json\/wp\/v2\/posts\/788","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/secure-pipelines.com\/ar\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/secure-pipelines.com\/ar\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/secure-pipelines.com\/ar\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/secure-pipelines.com\/ar\/wp-json\/wp\/v2\/comments?post=788"}],"version-history":[{"count":2,"href":"https:\/\/secure-pipelines.com\/ar\/wp-json\/wp\/v2\/posts\/788\/revisions"}],"predecessor-version":[{"id":1583,"href":"https:\/\/secure-pipelines.com\/ar\/wp-json\/wp\/v2\/posts\/788\/revisions\/1583"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/secure-pipelines.com\/ar\/wp-json\/wp\/v2\/media\/1564"}],"wp:attachment":[{"href":"https:\/\/secure-pipelines.com\/ar\/wp-json\/wp\/v2\/media?parent=788"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/secure-pipelines.com\/ar\/wp-json\/wp\/v2\/categories?post=788"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/secure-pipelines.com\/ar\/wp-json\/wp\/v2\/tags?post=788"},{"taxonomy":"post_folder","embeddable":true,"href":"https:\/\/secure-pipelines.com\/ar\/wp-json\/wp\/v2\/post_folder?post=788"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}