4 ms·
> I'm not sure I followed your setup properly, but with the private registry defined as your 'proxy.remoteurl', you shouldn't have to worry about the Hub in par
by tetha 4y ago
> I'm not sure I followed your setup properly, but with the private registry defined as your 'proxy.remoteurl', you shouldn't have to worry about the Hub in particular - unless it's looking there, or people are pushing bad things into it
That is exactly the thing I am worried about, as we have a pull-through mirror for the docker hub.
What happens if some goofus container from that chaotic team pulls in knownOSS/component, but knownOSS got deleted and - after 30 days of available recon by _all_ malicious teams on the planet - got squatted instantly afterwards with rather vile malware? Spend some pennies to make a dollar by getting into a lot of systems.
Obviously, you can throw a million shoulds at me, shouldn't do that, should rename + vendor and such (though how would you validate the image you mirror.), but that's a messy thing to deal with and I am wondering about a centralized way to block it without needing anyone but the registry/mirror admins.
- bravetraveler 4y agoAh I see! I misunderstood, didn't realize that it's pointing to the Hub. I assumed the more strict sense of 'private' :) The Docker-provided registry software is limited in terms of "don't go here". You get all of upstream, essentially Quay or Harbor are more configurable in that regard, but I'm less familiar. We're privileged, being already very-offline and signature heavy... and that's someone else. I just run the systems/services!