cm0002@lemmy.world to Programmer Humor@programming.dev · vor 1 JahrHow Docker was bornlemmy.mlimagemessage-square28linkfedilinkarrow-up1784arrow-down122cross-posted to: programmerhumor@lemmy.ml
arrow-up1762arrow-down1imageHow Docker was bornlemmy.mlcm0002@lemmy.world to Programmer Humor@programming.dev · vor 1 Jahrmessage-square28linkfedilinkcross-posted to: programmerhumor@lemmy.ml
minus-squarekitnaht@lemmy.worldBannedlinkfedilinkarrow-up17arrow-down1·vor 1 JahrThe biggest problem that I have with docker is honestly, the fear of a supply-chain attack.
minus-squareMrPistachios@lemmy.todaylinkfedilinkEnglisharrow-up5·vor 1 Jahrbut wouldnt that be an issue regardless of docker
minus-squareDrasla@lemmy.studiolinkfedilinkarrow-up1·vor 1 JahrYou mean compromised code sneaking into Docker images? Or a DOS on dockerhub?
minus-squareroofuskit@lemmy.worldlinkfedilinkEnglisharrow-up2·vor 1 JahrThey worry about someone replacing the docker image on the hosting server with a malicious modified version for people to pull down during updates.
minus-squarezalgotext@sh.itjust.workslinkfedilinkarrow-up8·vor 1 JahrThis worry exists for literally every 3rd party dependency, not just docker, and is addressed the same way - by running tests and vulnerability scans in a sandboxed test environment before shipping to prod
minus-squareroofuskit@lemmy.worldlinkfedilinkEnglisharrow-up2·vor 1 JahrI was just answering a question. I had the same response above.
minus-squarezalgotext@sh.itjust.workslinkfedilinkarrow-up2·vor 1 JahrAnd I was just adding extra details
minus-squarekitnaht@lemmy.worldBannedlinkfedilinkarrow-up5arrow-down3·vor 1 JahrSupply chain attack has a definition. And it has nothing to do with DDoS.
The biggest problem that I have with docker is honestly, the fear of a supply-chain attack.
deleted by creator
but wouldnt that be an issue regardless of docker
You mean compromised code sneaking into Docker images? Or a DOS on dockerhub?
They worry about someone replacing the docker image on the hosting server with a malicious modified version for people to pull down during updates.
This worry exists for literally every 3rd party dependency, not just docker, and is addressed the same way - by running tests and vulnerability scans in a sandboxed test environment before shipping to prod
I was just answering a question. I had the same response above.
And I was just adding extra details
Supply chain attack has a definition. And it has nothing to do with DDoS.
deleted by creator