2 ms·
> In the end, what gets deployed is the responsibility of the entity doing the deployment. Yes and no, I don't disagree, but remember classic hosting, semi-ma
by mrweasel 5y ago
> In the end, what gets deployed is the responsibility of the entity doing the deployment.
Yes and no, I don't disagree, but remember classic hosting, semi-managed infrastructure still exists. We often get container images delivered and are responsible for the operational side of things, but we have no control of what is actually inside the containers.
Sure we can make requests, or inform a customer that we believe what they are doing isn't safe. Ideally we could reject a request to run a container, but in reality that's not really an option. That shifts the responsibility of security more in the direction of the developers and they often do not have regular patch management as a priority.
- dsr_ 5y agoIf your organization isn't in control of the software you are running, you are a service provider and you have to treat them as potentially hostile external entities. Your responsibility is for the infrastructure, and you must explicitly disclaim responsibility for the functionality and security of anything inside the containers. This is, incidentally, the antithesis of "devops".