21–25 of 25 posts
Don't use Docker. Use heavy sigh systemd security features. Yes, this is something that systemd actually does really well. And it keeps all your processes and files visible and inspectable to standard unix tools (ps, htop, ls, etc). * chroot * cgroups * PrivateNetwork * PrivateTmp * isolated devices * IPAddressAllow * SocketBindAllow * ReadOnlyPaths https://docs.arbitrary.ch/security/systemd.html
The segmentation into attack vectors is interesting. But images from individuals on something like DockerHub have always been untrusted. I expected to read here about recent compromised official DockerHub library images. I don't see how that threat is new or now more pressing than ever. How would you even count something like `docker pull vesnpsexga/joomla` as typosquatting vs. `docker pull joomla`? It's not even clo…
With Docker, how well is the host protected from malicious images?
It's controversial because there are definitely a contingent of people who really want to believe docker adds a realistic layer of security isolation. But no credible security researcher, security engineer or even Docker the company itself has ever considered Docker the container runtime to be a security mechanism (well, outside of the fact it's leveraging kernel namespaces)[0]. There's also a lot of really bad secur…
These kinds of repository are probably best used by drive-by malware.
I think this (and all) repository's download log should be made open, or at least made viewable prior to your downloading step as part of the trust profiling.
This sounds like much-ado about nothing. We probably need to be far more concerned about "Docker Official Image"s that have been deprecated and are no longer receiving updates such as the "official" /_centos images (including centos7 which in theory isn't EOL but RedHat apparently doesn't care).
Redhat has moved all their stuff to quay.io.