Docker Hub security dissed, dodgy container image data damned

Quality journalism! Kromtech’s butt hurt :)

Docker container security

Early on, I complained about the lack of cryptographically-signed Docker images and brought up the inherent problems of letting random people publicly post executable code (images) whenever they want, on the Github repo issues and was met with a brush off with “edge-cases” and a vague decision-by-committee deferment. These are the sort of developers whom chmod 777 and don’t understand the need for SELinux. I’ve concluded CoreOS and rkt are better solutions on the stack side, and that it’s stupid to use public containers in anything real... always build your own container base images from known-good, gpg-verified media/repos. Then and only they can you be sure this “easy sharing” BS isn’t dragging along noob mistakes/fragility or malware. Never get lazy by depending on random heaps of layered amateurism.