12 ms·

Docker Hub still does not have any form of 2FA. Even SMS 2FA would be something / great at this point. As an attacker, I would put a great deal of focus on att

Docker Hub still does not have any form of 2FA. Even SMS 2FA would be something / great at this point. As an attacker, I would put a great deal of focus on attacking company’s registries on Docker Hub. They can’t have 2FA, so the work/reward ratio is quite high.

icedchai 7y ago
Why would any serious company not use a private registry?
- sneak 7y ago
  If you follow best practices your containers don't contain secrets; distributing credentials to access a private registry is itself a bit of overhead. Not everyone makes/uses software where the software itself is secret.
  - hosh 7y ago
    We're talking about fixing the underlaying images to a fixed point, not about baking in secrets into the image. And there are plenty of uses for using proprietary images. For example, I have done workflows where the properitary code is layered on top of open-source code. (Although if I were to redo those CI/CD pipelines again, I would use the de-facto buildpack standard instead; even then, the buildpack slug itself would be properitary and requires an artifact store of some kind). Either way, using GCP or AWS registry that integrates with their IAM systems works well. The newer versions of docker contains a plugin system, so both GCP and AWS command line tooling can hook in their own authentication mechanisms in there.
  - Cpoll 7y ago
    I think the risk in this case is an attacker writing to the registry, not reading it. If I can push changes to your 'prod' tagged image, I'm going to have a very good time.
- xemdetia 7y ago
  You would be surprised on how large a hurdle this is, even inside 'serious companies' when stable external/internal artifacts come up. A lot of developers who cut their teeth on these public repositories complain heavily over the 'friction' of ensuring that they have a reliable place to pull things from. This isn't unique to docker and also includes things like python, ruby, go, node, and other modern packaging systems. The fact that in 3 years from now when they need to update the code the vulnerable/deprecated package is gone/changed URL/whatever seems to be a learned lesson.
  - longcommonname 7y ago
    Really the most difficult part is mirroring everything, but managing your dependencies without using the latest tag
- adambyrtek 7y ago
  AWS Docker registry (ECR) is a good middle ground since you don't have to maintain your own registry and you can take advantage of IAM to improve security.
  - hosh 7y ago
    Similarly GCP registry if you are on GCP. I have used them. It isn't that much of a hardship if you are already cloud native. Companies with legacy or hybrid infrastructure may need to jump through additional hoops.
  - GordonS 7y ago
    Similarly there is Azure Container Registry. Only issue I've found with it is that access permissions are not granular enough - for example, you can't specify that a user/service principal should only be able to access particular tags or repos. Not sure how that compares to the AWS and GCP offerings?
  - rumanator 7y ago
    Some CICD services such as GitLab already provide docker image registries per project for free, and enable users to create any number of projects.
- bdcravens 7y ago
  Same reason they use public apt/rubygems/npm/etc. Same reason they use a secured, but public, Github/Gitlab. Same reason many use hosted CI, bug tracker, APM, etc.
- tedivm 7y ago
  This is pretty much a requirement for any serious company, but it still doesn't solve the problem completely as lots of builds depend on public docker hub containers. When the docker hub outage happened earlier this week our production systems were fine, but our dev processes slowed down quite a bit until it was resolved. Unfortunately though docker hub really is a dumpster fire of a service, otherwise I'd have no problem just using their private repo features. However there are so many problems with that site that it's easier just to jump to AWS ECR or Github's new service.
ljm 7y ago
Good time to point out that if you’re depending on public docker images, use the SHA reference. Named tags are mutable and you can’t depend on your layer cache for stability. Any and all of that can change under your nose on a new build and you won’t know how to debug it without wasting a few hours sourcing the bug. The SHA protects you from that because there can only be one version of it. (e.g I’ve had a few where a ruby image switched from Debian 9 to Debian 10, on most of the labels. It broke a lot of stuff and you just had to guess that they kept the old version on its own label, because Docker Hub didn’t say anything about it.)
- urda 7y ago
  I haven't done a ton of Docker DevOps at scale, but shouldn't teams be pulling images, vetting, and then hosting on their own hub?
  - markovbot 7y ago
    That'd probably be ideal but in reality most people don't do that.
    - taberiand 7y ago
      Worse, I've had people scoff at the idea.
      - jedieaston 7y ago
        And then things like the Docker Hub outage this week happen and people wonder why their pipelines grind to a halt.
        johnchristopher 7y ago
        How hard is it to set up your own hub for private use ?
        7y ago
CiPHPerCoder 7y ago
> Even SMS 2FA would be something / great at this point. Oh god please no. TOTP isn't that difficult to set up. I'll even help make it happen. Don't use SMS for 2FA.
- sha666sum 7y ago
  SMS 2FA is better than nothing if, and only if, you don't allow password resetting by owning the SMS.
  - CiPHPerCoder 7y ago
    TOTP is better than SMS in that it's secure with fewer caveats. Why am I being downvoted? I'm literally willing to volunteer days of my time, unpaid, to prevent SMS 2FA in favor of something more secure (i.e. TOTP).
    - RKearney 7y ago
      > Why am I being downvoted? I can't speak for all of those who downvoted you, but the comment you responded to mentioned how SMS based 2FA would be better than what they do today (i.e. nothing). This is a fact. SMS 2FA, regardless of how bad it is, is still another hurdle an attacker would have to overcome. An additional hurdle, no matter how small, is still better than nothing at all. Therefore the assertion that SMS 2FA would be better than what they do today is simply an irrefutable fact. If you left off the "Oh god please no." portion of your comment, you may not have been downvoted.
      - tedunangst 7y ago
        SMS 2FA includes the negative energy of "we have this, so we don't need TOTP or something better." It may well be a net negative. The corollary to don't let the perfect be the enemy of the good is don't let the barely better be the enemy of the substantially better.
      - Thorrez 7y ago
        Generally companies treat the SMS 2FA as an additional check, so it's a security improvement. But some companies also then allow it to be used for password recovery, which is generally a security regression. Also multiple companies have used SMS 2FA numbers for ad targeting. https://news.ycombinator.com/item?id=21197553 https://news.ycombinator.com/item?id=21197553
IronWolve 7y ago
No kidding. Tensorflow/Nvidia GPU docker containers are an industry standard for AI. The security of frequent internet updates is scary.
shaneakr 7y ago
Docker Hub 2FA was launched today

icedchai 7y ago

Why would any serious company not use a private registry?

sneak 7y ago
If you follow best practices your containers don't contain secrets; distributing credentials to access a private registry is itself a bit of overhead. Not everyone makes/uses software where the software itself is secret.
- hosh 7y ago
  We're talking about fixing the underlaying images to a fixed point, not about baking in secrets into the image. And there are plenty of uses for using proprietary images. For example, I have done workflows where the properitary code is layered on top of open-source code. (Although if I were to redo those CI/CD pipelines again, I would use the de-facto buildpack standard instead; even then, the buildpack slug itself would be properitary and requires an artifact store of some kind). Either way, using GCP or AWS registry that integrates with their IAM systems works well. The newer versions of docker contains a plugin system, so both GCP and AWS command line tooling can hook in their own authentication mechanisms in there.
- Cpoll 7y ago
  I think the risk in this case is an attacker writing to the registry, not reading it. If I can push changes to your 'prod' tagged image, I'm going to have a very good time.
xemdetia 7y ago
You would be surprised on how large a hurdle this is, even inside 'serious companies' when stable external/internal artifacts come up. A lot of developers who cut their teeth on these public repositories complain heavily over the 'friction' of ensuring that they have a reliable place to pull things from. This isn't unique to docker and also includes things like python, ruby, go, node, and other modern packaging systems. The fact that in 3 years from now when they need to update the code the vulnerable/deprecated package is gone/changed URL/whatever seems to be a learned lesson.
- longcommonname 7y ago
  Really the most difficult part is mirroring everything, but managing your dependencies without using the latest tag
adambyrtek 7y ago
AWS Docker registry (ECR) is a good middle ground since you don't have to maintain your own registry and you can take advantage of IAM to improve security.
- hosh 7y ago
  Similarly GCP registry if you are on GCP. I have used them. It isn't that much of a hardship if you are already cloud native. Companies with legacy or hybrid infrastructure may need to jump through additional hoops.
- GordonS 7y ago
  Similarly there is Azure Container Registry. Only issue I've found with it is that access permissions are not granular enough - for example, you can't specify that a user/service principal should only be able to access particular tags or repos. Not sure how that compares to the AWS and GCP offerings?
- rumanator 7y ago
  Some CICD services such as GitLab already provide docker image registries per project for free, and enable users to create any number of projects.
bdcravens 7y ago
Same reason they use public apt/rubygems/npm/etc. Same reason they use a secured, but public, Github/Gitlab. Same reason many use hosted CI, bug tracker, APM, etc.
tedivm 7y ago
This is pretty much a requirement for any serious company, but it still doesn't solve the problem completely as lots of builds depend on public docker hub containers. When the docker hub outage happened earlier this week our production systems were fine, but our dev processes slowed down quite a bit until it was resolved. Unfortunately though docker hub really is a dumpster fire of a service, otherwise I'd have no problem just using their private repo features. However there are so many problems with that site that it's easier just to jump to AWS ECR or Github's new service.

ljm 7y ago

Good time to point out that if you’re depending on public docker images, use the SHA reference. Named tags are mutable and you can’t depend on your layer cache for stability. Any and all of that can change under your nose on a new build and you won’t know how to debug it without wasting a few hours sourcing the bug. The SHA protects you from that because there can only be one version of it. (e.g I’ve had a few where a ruby image switched from Debian 9 to Debian 10, on most of the labels. It broke a lot of stuff and you just had to guess that they kept the old version on its own label, because Docker Hub didn’t say anything about it.)

urda 7y ago
I haven't done a ton of Docker DevOps at scale, but shouldn't teams be pulling images, vetting, and then hosting on their own hub?
- markovbot 7y ago
  That'd probably be ideal but in reality most people don't do that.
  - taberiand 7y ago
    Worse, I've had people scoff at the idea.
    - jedieaston 7y ago
      And then things like the Docker Hub outage this week happen and people wonder why their pipelines grind to a halt.
      - johnchristopher 7y ago
        How hard is it to set up your own hub for private use ?
        7y ago

CiPHPerCoder 7y ago

> Even SMS 2FA would be something / great at this point. Oh god please no. TOTP isn't that difficult to set up. I'll even help make it happen. Don't use SMS for 2FA.

sha666sum 7y ago
SMS 2FA is better than nothing if, and only if, you don't allow password resetting by owning the SMS.
- CiPHPerCoder 7y ago
  TOTP is better than SMS in that it's secure with fewer caveats. Why am I being downvoted? I'm literally willing to volunteer days of my time, unpaid, to prevent SMS 2FA in favor of something more secure (i.e. TOTP).
  - RKearney 7y ago
    > Why am I being downvoted? I can't speak for all of those who downvoted you, but the comment you responded to mentioned how SMS based 2FA would be better than what they do today (i.e. nothing). This is a fact. SMS 2FA, regardless of how bad it is, is still another hurdle an attacker would have to overcome. An additional hurdle, no matter how small, is still better than nothing at all. Therefore the assertion that SMS 2FA would be better than what they do today is simply an irrefutable fact. If you left off the "Oh god please no." portion of your comment, you may not have been downvoted.
    - tedunangst 7y ago
      SMS 2FA includes the negative energy of "we have this, so we don't need TOTP or something better." It may well be a net negative. The corollary to don't let the perfect be the enemy of the good is don't let the barely better be the enemy of the substantially better.
    - Thorrez 7y ago
      Generally companies treat the SMS 2FA as an additional check, so it's a security improvement. But some companies also then allow it to be used for password recovery, which is generally a security regression. Also multiple companies have used SMS 2FA numbers for ad targeting. https://news.ycombinator.com/item?id=21197553 https://news.ycombinator.com/item?id=21197553

IronWolve 7y ago

No kidding. Tensorflow/Nvidia GPU docker containers are an industry standard for AI. The security of frequent internet updates is scary.

shaneakr 7y ago

Docker Hub 2FA was launched today