> netboots signed images
There is no safe way to do this. Netboot picks up the fastest dhcp/tftp server to reply.
which means there is nothing to stop something booting a hypervisor, then booting your image.
There is no safe way to do this. Netboot picks up the fastest dhcp/tftp server to reply.
which means there is nothing to stop something booting a hypervisor, then booting your image.
They won't be relying on the BIOS netboot that picks up the first DHCP server, but rather a custom bootloader that will check the signature on the image before running it.