exploit-check/python-deployment.yaml at main · ndouglas-cloudsmith/exploit-check · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
apiVersion: apps/v1
kind: Deployment
metadata:
  name: python-app-deployment
  namespace: default
  labels:
    app: python-app
spec:
  replicas: 1
  selector:
    matchLabels:
      app: python-app
  template:
    metadata:
      labels:
        app: python-app
    spec:
      containers:
      - name: python-container
      # image: python:3.11-slim <-- Insecure public Docker Hub
      # cgr.dev/chainguard/python:latest <-- Very secure Chainguard dev image
        image: docker.cloudsmith.io/acme-corporation/acme-repo-one/python:latest
        # Installing dependencies on the fly for demonstration
        command: ["/bin/bash", "-c"]
        args:
          - |
            pip install requests;
            echo "import requests; print('Dependencies installed! Status:', requests.get('https://google.com').status_code)" > app.py;
            python app.py;
            sleep infinity;
        resources:
          limits:
            memory: "128Mi"
            cpu: "500m"