2 ms·

Since I started looking at images I've seen a lot of issues. Artifact Hub (which lets you find Helm charts, OLM operators, etc) will show scan details when it

by mfer 6y ago

Since I started looking at images I've seen a lot of issues. Artifact Hub (which lets you find Helm charts, OLM operators, etc) will show scan details when it has enough information. If we look at the operators (and these are available in openshift today and considered curated by Red Hat) we can see a lot of operators with images that have issues... https://artifacthub.io/packages/search?page=1&ts_query_web=database&kind=3 https://artifacthub.io/packages/search?page=1&ts_query_web=d... I know this doesn't directly deal with Docker Hub but does highlight the cultural problem with addressing security.

x86_64Ubuntu 6y ago
Lots of Ds and Fs in that list you linked. It says that it's the Community Operator that put it out there, so I'm kind of scared that a base image from people who should know is so insecure.
- mfer 6y ago
  These are the exact same things and versions listed on the Red Hat managed and curated Operator Hub. I'll say that I poked a couple of them that matter to me to let them know about the security issues. They hadn't even noticed. Ick.