1
Docker Image Insecurity
Docker's report that a downloaded image is "verified" is based solely on the presence of a signed manifest, and Docker never verifies the image checksum from the manifest.
Jonathan Rudenberg
Recently while downloading an “official” container image with Docker I saw this line:
- Popular posts
- 2
- Total points
- 433
- HN comments
- 134
- Rank
- #6,097 personal
Visit titanous.com → RSS feedOn Hacker News Jul 2012 – Dec 2014
2
Vulnerabilities in Heroku's Build System
Last week I discovered a major security flaw in the Heroku Cedar stack build. This vulnerability exposed sensitive information including API keys, private keys and server credentials.