Is it unreasonable to request more information about the attack that can help us understand whether our builds and images were affected? We might've built and deployed images containing or receiving production secrets which could be compromised. This is very important information at the moment.
IMO, dockerhub should publish:
* exact time when attack happened, so we know exactly what builds might have pulled malicious images
* degree of access the hackers gained (whether it had ro or rw access, and to what exactly)
* mechanisms used for password/tokens/pii/etc. security (salt, encryption, hashing alg...)
* list of affected public accounts/images
Instead of last point, or complementing it, it would be useful if image providers would confirm on their official channels if their images were or weren't compromised, and which tags&shas are (un)safe to use.
EDIT: https://success.docker.com/article/docker-hub-user-notificat... is now updated with additional information:
Q: What happened?
There was a brief period of unauthorized access to a Docker Hub database. During this time some sensitive data from approximately 190,000 accounts may have been exposed (less than 5% of Hub users). Data includes usernames and hashed passwords for a small percentage of users as well as GitHub and Bitbucket tokens for Docker autobuilds. All these tokens have been revoked.
Q: Were any of the Docker Official Images impacted by this incident?
No Official Images have been compromised. We have additional security measures in place for our Official Images including GPG signatures on git commits as well as Notary signing to ensure the integrity of each image.