4 ms·
You can use the `docker trust` to verify which key (if any) was used to sign a given docker image. The `docker history` command will also give you a list of ea
by Patrick_Devine 8y ago
You can use the `docker trust` to verify which key (if any) was used to sign a given docker image. The `docker history` command will also give you a list of each of the layers as well as the command which was used to create the layer.
- MPSimmons 8y agoIt's trivial to insert software into the build pipeline without being noticed. Run your own devpi server, build a compromised version of any dependency you want, and you can install whatever you would like, with no sign of it in the Dockerfile.