Docker Compose镜像digest固定与来源治理（服务-白名单）最佳实践

实现示例

type Service = { name: string; image: string; digest?: string }

const allowRegistries = new Set<string>(['docker.io','ghcr.io','registry.example.com'])

function hasDigest(s: Service): boolean { return !!s.digest && /^[A-Fa-f0-9]{64}$/.test(s.digest) }

function validImage(s: Service): boolean { const m = /^(\w[\w.-]+)\/(\w[\w.-]+):([\w.-]+)$/.exec(s.image); return !!m }

function registryAllowed(s: Service): boolean { try { const parts = s.image.split('/'); const host = parts[0]; return allowRegistries.has(host) } catch { return false } }

function evaluate(list: Service[]): { ok: boolean; errors: string[] } {
  const errors: string[] = []
  for (const s of list) {
    if (!s.name || !validImage(s) || !registryAllowed(s)) errors.push(`image:${s.name}`)
    if (!hasDigest(s)) errors.push(`digest:${s.name}`)
  }
  return { ok: errors.length === 0, errors }
}

审计与运行治理

• 审计服务镜像域与 `digest` 固定；异常阻断并输出修复建议。
• 部署变更需审批与归档。