Thousands of images on Docker Hub leak auth secrets, private keys

Fryboyter@discuss.tchncs.de to Linux@lemmy.ml – 215 points –
bleepingcomputer.com

The result of the study can be found at https://arxiv.org/pdf/2307.03958.pdf.

41

You are viewing a single comment
View all comments

Of course. In my opinion, what Docker is used for on Hub is a different model than it was originally supposed to solve. It was designed as a solution for enterprise where the development team had no easy control over the production environment, so the solution was to bundle the platform with the software. However, your production team is usually trustworthy, so leaking secrets via the container isn't an issue (or actually sometimes you wanted the image to include secrets).

The fact that Hub exists is a problem in itself in my opinion. Even things like the AUR - which comes with its own set of problems - is a better solution.

nix provides a solution to build clean Docker images. But then again it only works for packages that are either in nixpkgs already or you have written a derivation for, the latter being probably more effort than a quick and dirty dockerfile.

Well not the Hub itself is the problem, rather the fact it's being used wrong. You're not supposed to publish your private images publicly, if you do that's your problem. The Hub (or Docker) are pretty much completely unrelated to this issue. People who do this are probably also going to leave S3 buckets unsecured, commit passwords to Git and so on and so forth.