Ask HN: What is your company's policy for Docker Hub?
4 comments
I would manage a private registry.
It's no different than trusting code in a 3pp library. I'd vet the code before running it. In some cases, you are giving the running container root access to your computer. Take a look at the Dirty Cow to exploit that allows you to break out of the container and control the host.
https://blog.paranoidsoftware.com/dirty-cow-cve-2016-5195-do...
You never know what people will put into their images. I built a tool to help reverse engineer images to find files people put in their images here.
https://github.com/P3GLEG/Whaler
I have found so much weird stuff that people build into the containers. I wouldn't trust them implicitly because it's a packaged black box.
It's no different than trusting code in a 3pp library. I'd vet the code before running it. In some cases, you are giving the running container root access to your computer. Take a look at the Dirty Cow to exploit that allows you to break out of the container and control the host.
https://blog.paranoidsoftware.com/dirty-cow-cve-2016-5195-do...
You never know what people will put into their images. I built a tool to help reverse engineer images to find files people put in their images here.
https://github.com/P3GLEG/Whaler
I have found so much weird stuff that people build into the containers. I wouldn't trust them implicitly because it's a packaged black box.
Thanks, that's a really useful tool and a good write-up on the utility of it.
In the short term I can probably convince the higher-ups that if I download the images manually and do some level of investigation using a tool like yours then it should account for some security.
Have you considered container scanning tools?
In the short term I can probably convince the higher-ups that if I download the images manually and do some level of investigation using a tool like yours then it should account for some security.
Have you considered container scanning tools?
Thanks for Whaler, looks nice.
I only knew about https://microbadger.com/ until now, but Whaler puts out more info.
I only knew about https://microbadger.com/ until now, but Whaler puts out more info.
Whaler looks great. As I understand it, it gives us a Dockerfile for a given image.
Do you know if it's possible to reverse engineer the entire source code of my app from the Docker image?
Do you know if it's possible to reverse engineer the entire source code of my app from the Docker image?
It depends on the language it was compiled in. It'll help you retrieve the binary, but you need to use the right tool to get the source code from it. It's not different than download an app on your host machine. It just make it easier for you to see what people put in an image. Android/Java is a language you can get the entire source from excluding if they obfuscate it.
It certainly depends how your company views its risks and how docker fits into their “threat model” - you’re running someone else’s code on your secure internal networks, so it should be treated like external/unauthorised software.
It’s not unheard of for Docker images to be backdoored or tampered with, just look at last month - https://arstechnica.com/information-technology/2018/06/backd...
If they’re trivial images, maybe mirror them internally and walk through their internals if that doesn’t consume too much time.
It’s not unheard of for Docker images to be backdoored or tampered with, just look at last month - https://arstechnica.com/information-technology/2018/06/backd...
If they’re trivial images, maybe mirror them internally and walk through their internals if that doesn’t consume too much time.
[deleted]
We run a private registry. Everything on it has to be home made on top of centOS.
Everything on your private registry requires a CentOS base image? What about public images? If you wanted to run elasticsearch or nginx, would your company policy be to build a custom nginx or elasticsearch container image?
At the company I work we have not opened up Docker Hub and are looking at the best way to manage and also provide security.