Docker executes builds as root which provides a build the opportunity to escape the container and become root on the host machine. In containerfactory.io's curr

Docker executes builds as root which provides a build the opportunity to escape the container and become root on the host machine. In containerfactory.io's current hosted setup, there are no guarantees that the machine an image is being built on hasn't already been compromised by a previous build. Quay.io has traditionally worked around this problem by patching user namespaces into docker, but they come with their own set of incompatibilities. As a result, we have found the best solution is to never trust the build machines given the risk of credentials being taken or builds being manipulated. Hosting your own copy completely avoids this issue, if you trust the people you work with ;)