docker - 如何保护公共(public) docker hub 图像？

Question

我正在尝试将 docker 镜像推送到公共(public)仓库中的 docker hub。我如何确保最终用户的安全，例如维护图像的完整性等。在公共(public) docker hub 存储库中推送图像时应遵循哪些最佳安全实践？

Answer 1

选项一:

可以查看Creating an Official Image部分说:

From a high level, an Official Image starts out as a proposal in the form of a set of GitHub pull requests. Detailed and objective proposal requirements are documented in the following GitHub repositories:

• docker-library/official-images

• docker-library/docs

The Official Images team, with help from community contributors, formally review each proposal and provide feedback to the author. This initial review process may require a bit of back-and-forth before the proposal is accepted.

There are also subjective considerations during the review process. These subjective concerns boil down to the basic question: “is this image generally useful?” For example, the python Official Image is “generally useful” to the larger Python developer community, whereas an obscure text adventure game written in Python last week is not.

Once a new proposal is accepted, the author is responsible for keeping their images up-to-date and responding to user feedback. The Official Repositories team becomes responsible for publishing the images and documentation on Docker Hub. Updates to the Official Image follow the same pull request process, though with less review. The Official Images team ultimately acts as a gatekeeper for all changes, which helps mitigate the risk of quality and security issues from being introduced.

---

选项二:

如果您使用的是私有(private)存储库，则这是一项付费服务​​

使用Docker Security Scanning为您的公共(public)图像。来自他们的文档:

Docker Cloud and Docker Hub can scan images in private repositories to verify that they are free from known security vulnerabilities or exposures, and report the results of the scan for each image tag.

---

关于公共(public) Docker 镜像本身的安全性:

Docker 镜像不经过安全审计或测试过程。所以它更喜欢使用 official images根据大约一年前发表的一篇文章，非官方图像可能容易受到攻击或包含恶意二进制文件，该文章谈到大约 17 个恶意图像属于一个用户，这些图像立即在 Docker Hub 门户网站上列出，它们在其中保持活跃2017 年 5 月和 2018 年 5 月，Docker 团队最终介入将他们拉下马。如果您打算使用非官方图像。您可以自行承担使用它的风险。

您可能想要检查的链接:

• [dockmylife/memorytest] Report malicious image
• Yet Another Crypto Mining Botnet?