> I don't see any warnings that a pull could result in complete compromise Well, certainly not by intention, but we did have CVEs issued with 1.3.3 and 1.3.2 w

> I don't see any warnings that a pull could result in complete compromise Well, certainly not by intention, but we did have CVEs issued with 1.3.3 and 1.3.2 which indicated that pulls were not secure. They're better now. Perfect? No, it does seem to be far better. I also put together a PoC of containerizing the entire 'docker pull' process and I'd like to see such privilege separation in the future. (https://github.com/ewindisch/docker-pull https://github.com/ewindisch/docker-pull) > the "verified" image message is still in the current release. I agree the "verified" image message is too strongly worded and this is what bug reports are for. Solomon seems to agree as well. > Do you have a link to this? It was on IRC. I'd have to dig it up, but I've filed a github issue in response to this conversation: https://github.com/docker/docker/issues/9793 https://github.com/docker/docker/issues/9793 > Is there a draft specification available for libtrust? https://github.com/docker/docker/issues/8093 https://github.com/docker/docker/issues/8093 https://github.com/docker/docker/issues/9015 https://github.com/docker/docker/issues/9015 > And yet you deployed it to production in 1.3. This is a valid criticism. I'll admit this code did not get the proper review and audit that I personally expected before being deployed. At Docker, we consider that a process bug. Things happen, we learn, we adapt. We didn't pull the code, but neither did we advise anyone else yet deploy a v2 server. Again, we have an active audit against this code currently, and the spec is developing.