3 ms·
You might as well drop privileges and tell the kernel to disallow any future privileges even with sudo/su or vulnerabilities. You can do this by using oneway i
by alsadi 10y ago
You might as well drop privileges and tell the kernel to disallow any future privileges even with sudo/su or vulnerabilities.
You can do this by using oneway in your docker entry point
https://github.com/muayyad-alsadi/oneway/blob/master/README.md https://github.com/muayyad-alsadi/oneway/blob/master/README....
- friendly_chap 10y agoThat's something really interesting, and it comes handy for a side project I have, but I don't think it fixes the problem with people hijacking the docker repo - they will just change the Dockerfile itself, right?
- alsadi 10y agoYes I agree. There are some things you can do for example you can have client certificates, only trusted clients can talk to your ci, and onlt trusted clients can push images. Only dev with ssh keys can push code. Your ci and registry are locked down (a container). All that might help.