3 ms·

It doesn't make Docker "not secure", it means that you need to verify image files in the way you verify other files you download. These changes are irrelevant t

• Alupis 12y ago
  > it means that you need to verify image files in the way you verify other files you download That is difficult to script automation that handles all cases. They have mechanisms built in that claim they provide the security you would expect, except that this article exposes their claims are absurdly false and actually dangerous because most users are not going to take the time to verify what the code is actually doing -- ie. they will just trust Docker's claim and move forward, potentially blindly exposing themselves. > Security is always a matter of degree. I agree, except in this case Docker has totally cast most considerations of security out the window. Simple "best practices" like verify user/untrusted input before you begin to work with it are completely ignored as evidenced in this article. > Docker users should be aware that the code responsible for downloading images is shockingly insecure. The issue is Docker sweeps this under the rug and continues to claim their platform is secure. Users trust this, and leave themselves exposed. > It doesn't make Docker "not secure" It sure seems to indicate that Docker is certainly not secure.