3 ms·
Ask HN: What is your company's policy for Docker Hub?
What is your company's policy regarding downloading images from Docker Hub and other related container registries (e.g. Google Container Registry)? Does your corporate proxy allow you to download anything? Do you need to get approval from a group/committee for each download?
At the company I work we have not opened up Docker Hub and are looking at the best way to manage and also provide security.
- graystevens 8y agoIt certainly depends how your company views its risks and how docker fits into their “threat model” - you’re running someone else’s code on your secure internal networks, so it should be treated like external/unauthorised software. It’s not unheard of for Docker images to be backdoored or tampered with, just look at last month - https://arstechnica.com/information-technology/2018/06/backdoored-images-downloaded-5-million-times-finally-removed-from-docker-hub/ https://arstechnica.com/information-technology/2018/06/backd... If they’re trivial images, maybe mirror them internally and walk through their internals if that doesn’t consume too much time.
- Raed667 8y agoWe run a private registry. Everything on it has to be home made on top of centOS.
- marcc 8y agoEverything on your private registry requires a CentOS base image? What about public images? If you wanted to run elasticsearch or nginx, would your company policy be to build a custom nginx or elasticsearch container image?
- k4ch0w 8y agoI would manage a private registry. It's no different than trusting code in a 3pp library. I'd vet the code before running it. In some cases, you are giving the running container root access to your computer. Take a look at the Dirty Cow to exploit that allows you to break out of the container and control the host. https://blog.paranoidsoftware.com/dirty-cow-cve-2016-5195-docker-container-escape/ https://blog.paranoidsoftware.com/dirty-cow-cve-2016-5195-do... You never know what people will put into their images. I built a tool to help reverse engineer images to find files people put in their images here. https://github.com/P3GLEG/Whaler https://github.com/P3GLEG/Whaler I have found so much weird stuff that people build into the containers. I wouldn't trust them implicitly because it's a packaged black box.
- amirathi 8y agoWhaler looks great. As I understand it, it gives us a Dockerfile for a given image. Do you know if it's possible to reverse engineer the entire source code of my app from the Docker image?
- k4ch0w 8y agoIt depends on the language it was compiled in. It'll help you retrieve the binary, but you need to use the right tool to get the source code from it. It's not different than download an app on your host machine. It just make it easier for you to see what people put in an image. Android/Java is a language you can get the entire source from excluding if they obfuscate it.
- cgrater 8y agoThanks, that's a really useful tool and a good write-up on the utility of it. In the short term I can probably convince the higher-ups that if I download the images manually and do some level of investigation using a tool like yours then it should account for some security. Have you considered container scanning tools?
- geberl 8y agoThanks for Whaler, looks nice. I only knew about https://microbadger.com/ https://microbadger.com/ until now, but Whaler puts out more info.
- deleted 8y ago[deleted]