4 ms·
> Incidentally, Docker now offer security scanning of dockerhub images, for a fee. This is weird. I thought it would be in their best interest that dockerhub's
by brunoqc 10y ago
> Incidentally, Docker now offer security scanning of dockerhub images, for a fee.
This is weird. I thought it would be in their best interest that dockerhub's images would have better reputations.
- jacques_chester 10y agoWell I think I may have mis-stated it. They offer scanning for Docker Cloud, which I understand to be their private registry / dev platform / once-and-future-PaaS. So it's an additional paywalled feature for private images, not for the public ones. And, in fairness, it's a surprisingly tricky problem which many well-heeled customers see as worth paying for. At Pivotal we've been working on "AppDog" to do something similar: inspect running applications on Cloud Foundry, tell you what dependencies are installed, what their licenses are, whether there are updates available and so on. And yeah. It's harder than it looks. There are edge cases upon edge cases. (Of course, nothing I say should be considered official comment etc etc).
- brunoqc 10y agoI think they also offer scanning for repositories on https://hub.docker.com/account/billing-plans/ https://hub.docker.com/account/billing-plans/ but only if you pay. > Docker Cloud and Docker Hub can scan images in private repositories to verify that they are free from known security vulnerabilities or exposures, and report the results of the scan for each image tag https://docs.docker.com/docker-cloud/builds/image-scan/ https://docs.docker.com/docker-cloud/builds/image-scan/
- jacques_chester 10y agoI need to get better at actually reading people's websites :)