Transcription
You read news on various Python sites, and every second article talks about some malicious code found in one module or another used by developers. The same thing happens in PMEs and NAS, and of course, on a smaller scale, this exists in other programming languages as well.
I've already discussed how bad this is and why it matters. In this video, I talk about recruitment and the theft of cryptocurrency wallets. In this video, I will share how I develop in different programming languages and do it, as I believe, safely.
In fact, this problem is very easy to solve because you just need to prevent the libraries you install from accessing your disks. This is done using various virtual systems, and the simplest way to run such a virtual system is Docker, which we will use today.
Yes, yes, this is an old, well-known method, but for some reason, many people don't use it, even though it literally takes just 10 lines of code to significantly enhance your security.
Let me show you how this looks and explain what it does, conditionally. I have a Node.js application that runs on Node version 22. Of course, I can run it in the terminal by simply typing some command like `npm run dev`, if I have it. But, I repeat, this is not entirely safe because I can't trust the libraries I installed from npm.
So, I want to run all of this in a virtual environment using Docker. There will also be Node version 22, and everything will work as if it were local but safely.
Here’s what the Docker Compose file I use looks like. I repeat, it’s just 10 lines of configuration. We specify the service name in case we want to add a database later. I will show you how that looks a bit later.
Our application image, or the image we want to use, is Node version 22 since I have a Node application. I specify the container name that will be displayed in Docker, the directory needed for use, which can vary for different programming languages and servers.
This Docker Compose file is created in the root of my project, so I need to connect all the files in my project to this special directory inside the image, the working directory. Therefore, I specify that my current directory will be located at this address in the virtual operating system.
The port I will use is 8080, and the command I want to execute is `npm run watch` for development. Now, I just run this file using the command `docker-compose up`, and we can see that my server is running. In this case, it’s a bot, and it works. I can actually use it; it’s available at `localhost:8080`.
I can now go to this address and see that my server is running. This is very convenient because, I repeat, all the libraries and modules that I now install from npm will work in this virtual environment, and they do not have access to my disks.
Here are those 10 lines I use for another project written in PHP. This is also a bot. I’m just interested in creating a serious bot using PHP. Everything is the same here, but a different image is used. I need PHP version 8.1, a different folder because it’s set up a bit differently, and a slightly different command that is executed.
I kept the same port, and if I now run this file, my project written in PHP will also be available locally, and I can continue developing it, which is very convenient. Here, I can also add a database if I need one, and this way, I will have a locally deployed, secure project, even with a database.
If you use an assistant, you can ask it to add a database. Let’s add MySQL, and you can see that I have code that allows me to add a database here. Now, if I run this Docker Compose, I will have a PHP server with my code and a database that I can connect to using this information.
All of this also works perfectly for Java or Python. Let’s rewrite this for Java with Spring. I accept the changes suggested by the AI, and you can see that Java is now supported. When I run this Docker Compose, some JAR file will execute, launching my application.
Or, for example, I can rewrite this file to support Python FastAPI. I will use this command, press Enter, and now this file works with Python version 3.8 and runs a FastAPI application that I can comfortably write in my editor.
So, just like that, with 10 lines of configuration, you can completely protect yourself from malicious modules and libraries downloaded from npm or elsewhere. And you don’t even have to install this programming language on your system; let it be installed only in the conditional Docker and run only there.
As a child already knows that Santa Claus doesn’t exist, he ordered all the gifts from us, and that’s a whole pile of disks for Xbox 360. So far, I’ve only been able to find four.