Docker AI Governance：让 AI Agent 在你的笔记本上安全地"上生产"

# agent-governance.yaml — Docker AI Governance 策略定义
version: "1.0"
governance:
  # 执行控制：只允许使用审核过的 Agent 饶像
  execution:
    allowedBaseImages:
      - "mycompany/ai-agent-runtime:1.2"
      - "docker/ai-agent-base:latest"
    runAsNonRoot: true          # Agent 容器必须以非 root 运行
    readOnlyRootFilesystem: true # 只读文件系统，防止 Agent 乱写
    maxMemory: "512m"           # 内存上限
    maxCPU: "0.5"               # CPU 上限

  # 网络隔离：精确控制可达端点
  network:
    defaultAction: deny         # 默认拒绝所有网络访问
    rules:
      - name: allow-internal-api
        action: allow
        destination: "10.0.0.0/8"    # 公司内网 CIDR
        ports: [443]
        protocol: tcp
      - name: allow-postgres
        action: allow
        destination: "db.internal.mycompany.com"
        ports: [5432]
        protocol: tcp
      - name: deny-public-internet
        action: deny
        destination: "0.0.0.0/0"      # 拒绝公网
        ports: ["*"]

  # 凭据管理：Agent 只能通过受控通道使用密钥
  credentials:
    allowedSecrets:
      - "company-api-key"       # 允许使用的 API Key 名称
      - "db-connection-string"  # 允许使用的数据库连接串
    injectionMethod: env_mount  # 凭据通过受控的环境变量挂载注入
    denyHardcoded: true         # 禁止在 Agent 配置中硬编码凭据

  # MCP 工具权限：白名单制
  mcpTools:
    defaultAction: deny         # 默认拒绝所有 MCP 工具调用
    allowed:
      - name: "github-mcp"
        methods: ["search_repos", "read_file", "create_issue"]
        # 明确允许的方法，create_pr 被故意排除
      - name: "internal-docs-mcp"
        methods: ["search", "read"]
      - name: "postgres-mcp"
        methods: ["query", "describe_table"]
        # 不允许 drop_table、alter_table 等危险操作

# docker-compose.yaml
services:
  ai-agent:
    image: mycompany/ai-agent-runtime:1.2
    governance: agent-governance.yaml   # 引用治理策略文件
    environment:
      - AGENT_TASK=code-review
      - MCP_CONFIG=/etc/mcp/config.json
    volumes:
      - ./mcp-config.json:/etc/mcp/config.json:ro
    networks:
      - agent-net

  # 凭据侧车服务：受控地提供密钥
  credential-proxy:
    image: docker/credential-proxy:latest
    governance: agent-governance.yaml
    environment:
      - SECRETS_SOURCE=vault            # 从 Vault 拉取凭据
      - SECRETS_LIST=company-api-key,db-connection-string
    networks:
      - agent-net

networks:
  agent-net:
    driver: bridge
    internal: true    # 内部网络，不暴露到宿主机外

// mcp-config.json — Agent 的 MCP 工具配置
{
  "mcpServers": {
    "github-mcp": {
      "command": "mcp-github",
      "args": ["--repo", "mycompany/backend"],
      "governance": {
        "allowedMethods": ["search_repos", "read_file", "create_issue"]
      }
    },
    "internal-docs-mcp": {
      "command": "mcp-docs",
      "args": ["--source", "https://docs.internal.mycompany.com"],
      "governance": {
        "allowedMethods": ["search", "read"]
      }
    },
    "postgres-mcp": {
      "command": "mcp-postgres",
      "args": ["--host", "db.internal.mycompany.com"],
      "governance": {
        "allowedMethods": ["query", "describe_table"]
      }
    }
  }
}

# 启动 Agent 服务
docker compose up -d

# 检查治理策略是否生效
docker compose exec ai-agent cat /etc/governance/status.json

# 验证网络隔离：Agent 应该无法访问公网
docker compose exec ai-agent curl -s --max-time 3 https://external-site.com
# 预期结果：连接超时或被拒绝

# 验证 Agent 可以访问内网 API
docker compose exec ai-agent curl -s https://api.internal.mycompany.com/health
# 预期结果：正常返回健康检查响应