3 ms·

> There is nothing particularly new in Jonathan's post and I thank him for facilitating a conversation. Maybe not new to you or Docker Inc staff, but I don't s

> There is nothing particularly new in Jonathan's post and I thank him for facilitating a conversation. Maybe not new to you or Docker Inc staff, but I don't see any warnings that a pull could result in complete compromise. On top of this, the inaccurate "verified" image message is still in the current release. > I have explicitly called out the need for containerization of the 'xz' process, and to run it in an unprivileged context. Do you have a link to this? > As this work comes out of review and a specification is finalized, we should expect to see a much better experience and more secure image transport Is there a draft specification available for libtrust? > However, as the libtrust and v2 image work, and subsequently, registry protocols are still in draft and security review, it is difficult for us to recommend that users yet attempt deploying these. And yet you deployed it to production in 1.3.

ewindisch 12y ago
> I don't see any warnings that a pull could result in complete compromise Well, certainly not by intention, but we did have CVEs issued with 1.3.3 and 1.3.2 which indicated that pulls were not secure. They're better now. Perfect? No, it does seem to be far better. I also put together a PoC of containerizing the entire 'docker pull' process and I'd like to see such privilege separation in the future. (https://github.com/ewindisch/docker-pull https://github.com/ewindisch/docker-pull) > the "verified" image message is still in the current release. I agree the "verified" image message is too strongly worded and this is what bug reports are for. Solomon seems to agree as well. > Do you have a link to this? It was on IRC. I'd have to dig it up, but I've filed a github issue in response to this conversation: https://github.com/docker/docker/issues/9793 https://github.com/docker/docker/issues/9793 > Is there a draft specification available for libtrust? https://github.com/docker/docker/issues/8093 https://github.com/docker/docker/issues/8093 https://github.com/docker/docker/issues/9015 https://github.com/docker/docker/issues/9015 > And yet you deployed it to production in 1.3. This is a valid criticism. I'll admit this code did not get the proper review and audit that I personally expected before being deployed. At Docker, we consider that a process bug. Things happen, we learn, we adapt. We didn't pull the code, but neither did we advise anyone else yet deploy a v2 server. Again, we have an active audit against this code currently, and the spec is developing.
- Titanous 12y ago
  >> Is there a draft specification available for libtrust? > https://github.com/docker/docker/issues/8093 https://github.com/docker/docker/issues/8093 https://github.com/docker/docker/issues/9015 https://github.com/docker/docker/issues/9015 libtrust does not appear to be mentioned in either of these issues.

ewindisch 12y ago

> I don't see any warnings that a pull could result in complete compromise Well, certainly not by intention, but we did have CVEs issued with 1.3.3 and 1.3.2 which indicated that pulls were not secure. They're better now. Perfect? No, it does seem to be far better. I also put together a PoC of containerizing the entire 'docker pull' process and I'd like to see such privilege separation in the future. (https://github.com/ewindisch/docker-pull https://github.com/ewindisch/docker-pull) > the "verified" image message is still in the current release. I agree the "verified" image message is too strongly worded and this is what bug reports are for. Solomon seems to agree as well. > Do you have a link to this? It was on IRC. I'd have to dig it up, but I've filed a github issue in response to this conversation: https://github.com/docker/docker/issues/9793 https://github.com/docker/docker/issues/9793 > Is there a draft specification available for libtrust? https://github.com/docker/docker/issues/8093 https://github.com/docker/docker/issues/8093 https://github.com/docker/docker/issues/9015 https://github.com/docker/docker/issues/9015 > And yet you deployed it to production in 1.3. This is a valid criticism. I'll admit this code did not get the proper review and audit that I personally expected before being deployed. At Docker, we consider that a process bug. Things happen, we learn, we adapt. We didn't pull the code, but neither did we advise anyone else yet deploy a v2 server. Again, we have an active audit against this code currently, and the spec is developing.

Titanous 12y ago
>> Is there a draft specification available for libtrust? > https://github.com/docker/docker/issues/8093 https://github.com/docker/docker/issues/8093 https://github.com/docker/docker/issues/9015 https://github.com/docker/docker/issues/9015 libtrust does not appear to be mentioned in either of these issues.