3 ms·

Not even close. Docker now has some terribly attempts at signing images on their registry iirc (docker inc signs them for the docker client). There is no optio

by TheDong 12y ago

Not even close. Docker now has some terribly attempts at signing images on their registry iirc (docker inc signs them for the docker client). There is no option for me, as a user, to build and sign my own image with my own pgp key afaik. My organization might already have a chain of trust, and docker is asking me to ignore that and just trust their signatures (which also only work on dockerhub as of docker 1.5... don't know about 1.6 because you can't use docker for at least a month after a release else security holes galore). Docker did nothing to encourage signing containers. At 1.0 they had no capability to do any signature, verification, whatsoever. It's being added as an afterthought, and poorly. If you look at the AppContainer specs, signatures (pgp based) were built in from the very beginning, it lets me create my own chain of trust (including incorporating other's keys), sign my own images, trust someone elses signature, does not trust the transport or storage medium, and has integration with the clients. If you want to convince me docker cares, you're going to have to give me examples of where they didn't fuck up... Tell me how I can use docker's tools to sign my own images, optionally trust my friend Alice, and securely download images that she uploaded to her own registry or dockerhub but signed with her gpg key without me having to trust docker inc. To my knowledge, all docker has right now is doing a 'tarsum' of images which assumes the registry is trusted and, even given that, can be downgraded for backwards compatibility reasons fairly trivially.

amouat 12y ago
Docker didn't fuck up when they hired the square guys. http://blog.docker.com/2015/03/secured-at-docker-diogo-monica-and-nathan-mccauley/ http://blog.docker.com/2015/03/secured-at-docker-diogo-monic... I agree that security and provenance is a real issue in Docker. It is however being worked on, and it will be solved. Presumably we will end up with some sort of app-store like framework with proper signatures and verification. Docker can't do everything at once. Give them a chance. The new version of the registry is a major step forward in this regard. In the meantime, what you can do is take redhat's advice. Rather than using a registry to get your images, operate a download site which stores archives of docker images that you can import with `docker load`. You can then also store signatures and check them yourself.
- TheDong 12y ago
  Cool, they hired some people, but I haven't noticed better security for it yet. Security is a real issue in docker and it is being worked on, but I don't think "give them a chance" is a justifiable response. They're not focusing on it strongly. They already should have focussed on it and didn't. Their entire codebase was written without a security design in place, so there's likely deep-seated refactoring that'll need to be done before any new security-related features should be trusted. They're working harder on monetizing and pushing docker as a production-ready standard as far as I can tell... I can understand not doing security before functionality, but it absolutely should be there before 1.0 or before you encourage others to use your software. Docker has already lost any chance of me trusting their security with their lack of focus on it and I don't think it's excusable. And if I'm doing what you say at the end, why the hell would I be using docker anyways then? I can already turn a tarballed fs into a linux container without docker (ty lxc); I thought the whole point of docker was sharing images and building on them and ... and having massive security flaws. Right.
  - Nursie 12y ago
    >> Security is a real issue in docker and it is being worked on, but I don't think "give them a chance" is a justifiable response. For a public facing system I would agree that means it's not ready for production use yet...
  - amouat 12y ago
    I agree that security should have been in place before they went 1.0. However, if you look at the work on the version of the registry (docker/distribution on github), they are taking things more seriously and trying to get the basics right. I find your last point a bit strange. We all know the Docker development experience is a lot better than raw lxc. I'm saying you can (and probably should) be more careful about provenance than the Docker Hub is. Note that there are alternatives to the Hub with better provenance stories e.g: https://access.redhat.com/search/#/container-images https://access.redhat.com/search/#/container-images (from https://securityblog.redhat.com/2014/12/18/before-you-initiate-a-docker-pull/ https://securityblog.redhat.com/2014/12/18/before-you-initia...) This might make things a bit more awkward than it was before, but it's still not the same as raw LXC. I feel your anger and I think it's understandable, but that doesn't mean things won't get better.

by TheDong 12y ago

amouat 12y ago

Docker didn't fuck up when they hired the square guys. http://blog.docker.com/2015/03/secured-at-docker-diogo-monica-and-nathan-mccauley/ http://blog.docker.com/2015/03/secured-at-docker-diogo-monic... I agree that security and provenance is a real issue in Docker. It is however being worked on, and it will be solved. Presumably we will end up with some sort of app-store like framework with proper signatures and verification. Docker can't do everything at once. Give them a chance. The new version of the registry is a major step forward in this regard. In the meantime, what you can do is take redhat's advice. Rather than using a registry to get your images, operate a download site which stores archives of docker images that you can import with `docker load`. You can then also store signatures and check them yourself.

TheDong 12y ago
Cool, they hired some people, but I haven't noticed better security for it yet. Security is a real issue in docker and it is being worked on, but I don't think "give them a chance" is a justifiable response. They're not focusing on it strongly. They already should have focussed on it and didn't. Their entire codebase was written without a security design in place, so there's likely deep-seated refactoring that'll need to be done before any new security-related features should be trusted. They're working harder on monetizing and pushing docker as a production-ready standard as far as I can tell... I can understand not doing security before functionality, but it absolutely should be there before 1.0 or before you encourage others to use your software. Docker has already lost any chance of me trusting their security with their lack of focus on it and I don't think it's excusable. And if I'm doing what you say at the end, why the hell would I be using docker anyways then? I can already turn a tarballed fs into a linux container without docker (ty lxc); I thought the whole point of docker was sharing images and building on them and ... and having massive security flaws. Right.
- Nursie 12y ago
  >> Security is a real issue in docker and it is being worked on, but I don't think "give them a chance" is a justifiable response. For a public facing system I would agree that means it's not ready for production use yet...
- amouat 12y ago
  I agree that security should have been in place before they went 1.0. However, if you look at the work on the version of the registry (docker/distribution on github), they are taking things more seriously and trying to get the basics right. I find your last point a bit strange. We all know the Docker development experience is a lot better than raw lxc. I'm saying you can (and probably should) be more careful about provenance than the Docker Hub is. Note that there are alternatives to the Hub with better provenance stories e.g: https://access.redhat.com/search/#/container-images https://access.redhat.com/search/#/container-images (from https://securityblog.redhat.com/2014/12/18/before-you-initiate-a-docker-pull/ https://securityblog.redhat.com/2014/12/18/before-you-initia...) This might make things a bit more awkward than it was before, but it's still not the same as raw LXC. I feel your anger and I think it's understandable, but that doesn't mean things won't get better.