Hacker News Reader

Comment by btmiller | Hacker News Reader

I can only think about this and be fearful due to the staggering number of Docker tutorials that happily whisk away the details as a sales pitch for streamlining the development process. Similar to the Node ecosystem, there's bound to be lots of junk out there that will never be updated.

View on HN

Docker containers multiply faster than rabbits in a forkbomb. It behooves Docker to do vulnerability and malware scans of containers, because letting random people have semi-sandboxed write and execute permissions on random other people's systems is a dangerous combination. That will cover some cases, but end-to-end personal accountability of container publishers is a necessary evil as there is unlikely a reasonable technical way to ensure there aren't malicious scripts in a given docker container. Signature-based malware scanning operates only in a limited fraction of the past since it requires submittal and review of what has been seen by a particular user AND submitted to a malware scanner publisher for analysis.

Scenario: Anonymous docker publisher installs a kiddie porn i2p or tor downloader service hidden in a container for Apache Kafka. Random corporate trainer accidentially picks said container, blogs a howto with it and suggests its use in in-person and web-based courseware. IANAL but Who's liable? The end-users using it? The trainer? Docker?

Disclaimer: I love Docker, but it needs some chain-of-custody assurance and greater visibility of container contents.

Docker ships with support for image signing, execution authorization (based on trusted signatures), and distribution endpoint authentication (TLS / PKI). Most image registries offer deep package inspection, OSS package manifests, and CVE visibility.

If all that isn't enough, individual image layers can be accessed and inspected by hand (they're just tar files).

If you're looking for "end-to-end chain of custody" you're going to need to specify the ends. Image signatures get you point-in-stack authorship assertions. I'm not sure what else anyone could ask for here.

Alpine isn't junk, but it is a layer in a lot of things that people use (ex. `golang:1-alpine`).

Docker just makes it super opaque when you have to rotate images.

Reply on news.ycombinator.com