Jonathan Rudenberg personal blog

Docker Image Insecurity

titanous.com 6 min read

Docker's report that a downloaded image is "verified" is based solely on the presence of a signed manifest, and Docker never verifies the image checksum from the manifest.

Points

263

HN comments

100

Submissions

1

Cited by

0 commenters

Security & PrivacyInfrastructure & DevOps2014

Related posts from the same era

Launching in 2015: A Certificate Authority to Encrypt the Entire Web

EFF Deeplinks20142,019 points461 commentscited by 6 details

Instagram's Million Dollar Bug

EEXFiLTRATED20151,562 points520 commentscited by 6 details

Let's Encrypt is Trusted

Let's Encrypt Blog20151,260 points311 comments details

Entering Public Beta

Let's Encrypt Blog20151,249 points213 comments details

Confirmed: The NSA is Spying on Millions of Americans

EFF Deeplinks20131,227 points444 commentscited by 3 details

Path texts my entire phonebook at 6 AM

BBranded3 Blog20131,223 points409 commentscited by 3 details