KKCE主机测评：把免备案VPS 变成“网络沙盒”用 Namespace + Docker 内部网做安全测试环境

# 非 root 用户 + 密钥
adduser sandbox
usermod -aG sudo sandbox
# 改 SSH 端口、禁密码
# /etc/ssh/sshd_config: Port 22222 / PermitRootLogin no / PasswordAuthentication no
# 防火墙：只开反代口
ufw default deny incoming
ufw allow 22222/tcp
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable
# 内核转发（Docker 要用）
sysctl -w net.ipv4.ip_forward=1

# 建一个沙盒网络命名空间
ip netns add sandbox-a
# 建 veth 对
ip link add veth-a type veth peer name veth-a-br
# 把一端塞进 namespace
ip link set veth-a netns sandbox-a
# 宿主机端挂桥
ip link set veth-a-br up
ip addr add 10.10.10.1/24 dev veth-a-br
# namespace 内配 IP
ip netns exec sandbox-a ip addr add 10.10.10.2/24 dev veth-a
ip netns exec sandbox-a ip link set lo up
ip netns exec sandbox-a ip link set veth-a up
ip netns exec sandbox-a ip route add default via 10.10.10.1

ip netns exec sandbox-a python3 -m http.server 8080

ip netns exec sandbox-a iptables -A OUTPUT -o lo -j ACCEPT
ip netns exec sandbox-a iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
ip netns exec sandbox-a iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
ip netns exec sandbox-a iptables -A OUTPUT -p tcp -m multiport --dports 80,443 -j ACCEPT
ip netns exec sandbox-a iptables -P OUTPUT DROP

services:
  app:
    build: .
    networks: [internal]
    expose:
      - "3000"
  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_PASSWORD: devonly
    networks: [internal]
    # 不写 ports，外网不可见
  redis:
    image: redis:7-alpine
    networks: [internal]
  proxy:
    image: nginx:alpine
    depends_on: [app]
    ports:
      - "127.0.0.1:8080:80"   # 只绑本地
    networks: [internal, front]
networks:
  internal:
  front:
    driver: bridge

ssh -L 5432:localhost:5432 -L 8080:localhost:8080 sandbox@免备案VPS_IP

server {
    listen 80;
    server_name preview.example.com;
    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

iptables -I DOCKER-USER -i eth0 ! -s CDN回源段 -p tcp --dport 8080 -j DROP

-- 假数据生成，不碰真 PII
INSERT INTO users (id, phone_hash, email_mask, city)
SELECT
  gen_random_uuid(),
  md5('fake_'||g::text),
  'user'||g||'@example.com',
  (ARRAY['HK','SG','TK','SJ'])[g%4+1];

deploy:
  resources:
    limits:
      memory: 512M
      cpus: "1.0"

docker run -d --memory=512m --cpus=1 --pids-limit=200 sandbox-img

curl -fsS http://127.0.0.1:8080/health || docker compose restart

preview:
  on: pull_request
  steps:
    - ssh sandbox@vps "TAG=$PR docker compose -f dc.sandbox.yml up -d"
    - curl 拨测 preview 域名
after-merge:
  - ssh sandbox@vps "docker compose -f dc.sandbox.yml down -v"

# 1. 命名空间/容器存活
ip netns list
docker ps --format '{{.Names}}\t{{.Status}}'
# 2. 端口暴露审计（防误绑公网）
ss -lntp | grep -E ':3306|:6379|:5432' && echo "WARN 公网裸库"
# 3. 外网可达拨测
curl -w "ttfb=%{time_starttransfer}\n" https://preview.example.com/health