cm0002@lemmy.world to Programmer Humor@programming.dev · 14 days agoHow Docker was bornlemmy.mlexternal-linkmessage-square34fedilinkarrow-up1820arrow-down123cross-posted to: programmerhumor@lemmy.ml
arrow-up1797arrow-down1external-linkHow Docker was bornlemmy.mlcm0002@lemmy.world to Programmer Humor@programming.dev · 14 days agomessage-square34fedilinkcross-posted to: programmerhumor@lemmy.ml
minus-squarekitnaht@lemmy.worldlinkfedilinkarrow-up19arrow-down1·14 days agoThe biggest problem that I have with docker is honestly, the fear of a supply-chain attack.
minus-squareNeatoBuilds@lemmy.todaylinkfedilinkEnglisharrow-up5·14 days agobut wouldnt that be an issue regardless of docker
minus-squareDrasla@lemmy.studiolinkfedilinkarrow-up1·14 days agoYou mean compromised code sneaking into Docker images? Or a DOS on dockerhub?
minus-squarekitnaht@lemmy.worldlinkfedilinkarrow-up5arrow-down3·14 days agoSupply chain attack has a definition. And it has nothing to do with DDoS.
minus-squareroofuskit@lemmy.worldlinkfedilinkEnglisharrow-up2·14 days agoThey worry about someone replacing the docker image on the hosting server with a malicious modified version for people to pull down during updates.
minus-squarezalgotext@sh.itjust.workslinkfedilinkarrow-up8·14 days agoThis worry exists for literally every 3rd party dependency, not just docker, and is addressed the same way - by running tests and vulnerability scans in a sandboxed test environment before shipping to prod
minus-squareroofuskit@lemmy.worldlinkfedilinkEnglisharrow-up2·14 days agoI was just answering a question. I had the same response above.
minus-squarezalgotext@sh.itjust.workslinkfedilinkarrow-up2·14 days agoAnd I was just adding extra details
The biggest problem that I have with docker is honestly, the fear of a supply-chain attack.
deleted by creator
but wouldnt that be an issue regardless of docker
You mean compromised code sneaking into Docker images? Or a DOS on dockerhub?
Supply chain attack has a definition. And it has nothing to do with DDoS.
deleted by creator
They worry about someone replacing the docker image on the hosting server with a malicious modified version for people to pull down during updates.
This worry exists for literally every 3rd party dependency, not just docker, and is addressed the same way - by running tests and vulnerability scans in a sandboxed test environment before shipping to prod
I was just answering a question. I had the same response above.
And I was just adding extra details