4 ms·
> use official docker images (as a mitigation) okay, but even for official images, figuring out the provenance of a build on docker hub is totally impossible
by awinter-py 7y ago
> use official docker images
(as a mitigation)
okay, but even for official images, figuring out the provenance of a build on docker hub is totally impossible
I challenge you to start with an image sha and tell me what git version (or even what repo) was used to create it
docker needs to get better at supply chain