5 ms·

I would be more interested in knowing what share of the top 10k or so docker images have critical vulnerabilities. The vast majority of those 4M docker images

I would be more interested in knowing what share of the top 10k or so docker images have critical vulnerabilities. The vast majority of those 4M docker images are stale and probably never pulled anymore. For example I probably have a good 100-200 public docker images on my account, virtually all of them will have critical vulnerabilities as I don't maintain them. Those are images I used for past personal projects, or testing something quickly, demo projects, iterating quickly on something etc. As soon as I am done with them, I forget about them and will never invest the time to maintain them, probably no one will ever pull them either (why would you pull an undocumented `randomuser/test-ml-my-shitty-project:latest` image?) I suspect a huge share of the 4M docker images analysed fall in that category.

mfer 6y ago
Since I started looking at images I've seen a lot of issues. Artifact Hub (which lets you find Helm charts, OLM operators, etc) will show scan details when it has enough information. If we look at the operators (and these are available in openshift today and considered curated by Red Hat) we can see a lot of operators with images that have issues... https://artifacthub.io/packages/search?page=1&ts_query_web=database&kind=3 https://artifacthub.io/packages/search?page=1&ts_query_web=d... I know this doesn't directly deal with Docker Hub but does highlight the cultural problem with addressing security.
- x86_64Ubuntu 6y ago
  Lots of Ds and Fs in that list you linked. It says that it's the Community Operator that put it out there, so I'm kind of scared that a base image from people who should know is so insecure.
  - mfer 6y ago
    These are the exact same things and versions listed on the Red Hat managed and curated Operator Hub. I'll say that I poked a couple of them that matter to me to let them know about the security issues. They hadn't even noticed. Ick.

mfer 6y ago

Since I started looking at images I've seen a lot of issues. Artifact Hub (which lets you find Helm charts, OLM operators, etc) will show scan details when it has enough information. If we look at the operators (and these are available in openshift today and considered curated by Red Hat) we can see a lot of operators with images that have issues... https://artifacthub.io/packages/search?page=1&ts_query_web=database&kind=3 https://artifacthub.io/packages/search?page=1&ts_query_web=d... I know this doesn't directly deal with Docker Hub but does highlight the cultural problem with addressing security.

x86_64Ubuntu 6y ago
Lots of Ds and Fs in that list you linked. It says that it's the Community Operator that put it out there, so I'm kind of scared that a base image from people who should know is so insecure.
- mfer 6y ago
  These are the exact same things and versions listed on the Red Hat managed and curated Operator Hub. I'll say that I poked a couple of them that matter to me to let them know about the security issues. They hadn't even noticed. Ick.