Hardening Docker with OPA and Harbor

In my article Docker Chronicles - Securing Docker instances with OPA and Harbor I am discussing the benefits that Open-Policy-Agent (OPA) and Harbor bring to securing Docker instances.

This post aims to guide you through the technical steps that I implemented for leveraging OPA and Harbor to not only secure your Docker containers but also to streamline the management of the policies. With OPA's powerful policy-as-code capabilities and Harbor's efficient image management system, you'll discover how to build a Docker ecosystem that's robust, secure, and compliant with industry best practices.

Let's begin.

The Setup

The code repository we will be using can be found here: https://github.com/httpsec-eu/opa-article

First we need to create the Gitlab repository for our policies. I named my repository OPA policies. If you want to use the bash commands you should change the environment vars to your own values.

export GL=gitlab.example.com      
export AUTH_TOKEN=gl-123456789ABCDEFG

curl --request POST --header "PRIVATE-TOKEN: ${AUTH_TOKEN}" \
     --header "Content-Type: application/json" --data '{
        "name": "opa-policies", "description": "OPA Policies", "path": "opa-policies",
        "namespace_id": "1", "initialize_with_readme": "true"}' \
     --url "https://${GL}/api/v4/projects/"

Now that we created the Gitlab project to host our policies, you can go ahead an copy the /docker folder from my repository. Along with the folder you can copy the .gitlab-ci.yml which provides you with the pipeline to create the OPA bundle and push it to Harbor.

The pipeline uses several variables described below:

Variable name	Purpose	Default value
BUNDLE	the name of the bundle which will be used as a Harbor artefact name	bundle
REPO	the folder name to build	./docker
TAG	the tag to set for the bundle when pushed to the repository	0.1
IMG_REPO	the repository URL domain	harbor.httpsec.eu
REPO_USER	the robot account to be used to login to Harbor	no value
REPO_PASS	the robot account password	no value

Next we need to create the Harbor repository. I named mine docker-opa. If you want, I provided a quick curl call to create and setup the project - please change the env vars to your own.

export REPO=harbor.example.com
export AUTH=[BASIC_AUTH_TOKEN_FOR_REOBOT_ACCOUNT_HERE]

curl -X 'POST' \
  "https://${REPO}/api/v2.0/projects" \
  -H 'accept: application/json' \
  -H 'Content-Type: application/json' \
  -H "authorization: Basic ${AUTH}" \
  -d '{
  "project_name": "docker-opa",
  "public": false,
  "metadata": {
    "enable_content_trust": "true",
    "enable_content_trust_cosign": "true"
  }
}'

Once the repository is created we need to create a Harbor robot account which we will use to login to Harbor from our Gitlab instance. You can set the variables REPO_USER and REPO_PASS as environment variables in the Gitlab project so that you don't have to enter them manually each time you run the pipeline.

Build the first bundle

Now that we created the two repositories we need to build our first OPA bundle. Go to your Gitlab project and select Build > Pipelines and click on Run pipeline. Fill in the variables or use the default values and select Run. Once the pipeline finishes you should see a new entry in the Harbor project similar to figure below.

NOTE: in the screenshot the name of the bundle is docker_auth because I set the Gitlab pipeline variable BUNDLE to the same name.

Configure Docker

The next steps are to install the Docker plugin and configure it to pull the policies from our Harbor instance.

Before we install the plugin we need to set the configuration file. The /etc/docker directory will be mounted as /opa in the container running the plugin, so let’s create a sub-directory for our configuration file there.

sudo mkdir -p /etc/docker/opa-config

Now copy or move the config.yaml file from my repository to the /etc/docker/opa-confg/ folder.

To install the plugin run the following command:

docker plugin install openpolicyagent/opa-docker-authz-v2:0.9 opa-args="-config-file /opa/opa-config/config.yaml"

To validate that our plugin has been installed correctly, run the following command:

docker plugin ls

If the everything works you should see an output similar to this:

ID             NAME                                      DESCRIPTION                                     ENABLED
d6cee85ae9aa   openpolicyagent/opa-docker-authz-v2:0.9   A policy-enabled authorization plugin for Do…   true

The last step is to configure Docker to use plugin. For this we need to edit the file, or create it if it doesn't exist, /etc/docker/daemon.json and add the following line:

"authorization-plugins": ["openpolicyagent/opa-docker-authz-v2:0.9"]

Run the following command to restart the Docker daemon:

sudo systemctl restart docker

To validate that everything is working run the following command:

docker image pull nginx:latest

And you should now receive an error similar to this:

$ docker image pull nginx:latest
Error response from daemon: authorization denied by plugin openpolicyagent/opa-docker-authz-v2:0.9: request rejected by administrative policy

Now your Docker instance is hardened.

Final thoughts

As we wrap up, hardening Docker environments by integrating Open Policy Agent (OPA) and Harbor represents a good starting step in securing containerised applications. Through this tutorial, we've seen how OPA's policy-as-code approach, combined with Harbor's robust image management capabilities, can create a more secure and manageable Docker ecosystem.

By implementing these tools, OPS and security teams can enforce consistent security policies and practices, reducing the risk of vulnerabilities and enhancing the overall security posture of their applications.