denhamparry

It is unlikely to have the bug as it sees more use, but it is worth checking. There have been previous CVEs with Pythons tar module.

It is possible to exploit this bug by crafting a file that has tar contents without a header, thus making it hard to detect even with recursive archives.

Thanks for the question!

Someone could release a malicious package that looks okay to a scanner tool, but when installed using uv can behave differently, allowing attackers to masquerade executable code.

In addition, for OCI images, it is possible to produce an OCI image that can overwrite layers in the tar file, or modify the index. This could be done in a way that is undetectable by the processor of the OCI image. Similar attacks can be done for tools that download libraries, binaries, or source code using the vulnerable parser, making a tar file that when inspected looks fine but when processed by a vulnerable tool, behaves differently.

I hope that answers your question?

I'm from Edera. If you have any questions please send them our way

Its a great blog post and loved the interactive elements around it

Edera developer here. I agree! But there are instances we need to run with additional capabilities, and we’re also dependent on people knowing how to do the right thing. We’re trying to improve this by setting this by default, but also improving the overall performance and efficiency of running containers

Edera developer here! Thank you for sharing and any feedback you have would be great! Edera Protect is written in Rust too, and our focus is also performance as well as isolation.

Edera developer here. Edera Protect is being developed to manage access to the GPU hardware on a Node with the containers running your workloads. We talk a lot about isolation between containers, but we're also focused on adding this isolation throughout the stack, from containers/processes down to hardware.

Edera developer here. gVisor is restrictive, but its at a cost of performance. Personally, I'd say Edera Protect is one level deeper. We create Edera Protect Zones to provide isolation, so we create a Zone that is isolated from the OS and hardware of the machine running the container. So we don't proxy or filter syscalls, as the isolation is a layer deeper. We are also focused on ensuring that Edera Protect is as performant (if not better) as running a container today with containerd.

Finally, if you wanted to, you could run gVisor within Edera Protect, but we feel that Edera Protect would already provide the security benefits that gVisor offer.

Edera developer here, we use Styrolite to run containers with Edera Protect. Edera Protect creates Zones to isolate processes from other Zones so that if someone were to break out of a container, they'd only see the zone processes. Not the host operating system or the hardware on the machine. The key difference here between us and other isolation implementations is that there is no performance degradation, you don't have to rebuild your container images, and that we don't require specific hardware (e.g. you can run Edera Protect on bare metal or on public cloud instances and everything else in-between).

I'm thankful that the important stuff is covered , there is helpful documentation over here btw https://edu.chainguard.dev/open-source/wolfi/overview/

Had the same feeling reading the article. I hadn't thought what happens when the airpod batteries fail. Will look for something more sustainable going forward.

I’m in my 30’s now and found out that I suffer from depression. It was a lightbulb moment realising that the feeling I’d become accustomed to for the previous 15 years was actually something.

For me, I never fitted in with anyone at University and felt alone. Going into work I started with small companies, providing tech for sales roles. The sales way of ‘high pressure’ was transferred to how projects should be managed.

Today I try and help out by building a community via running a meet-up. The people I have around me today and the confidence I have to be able to be depressed and get out of it with the help of others around me keeps me going.