Auf YouTube findest du die angesagtesten Videos und Tracks. Außerdem kannst du eigene Inhalte hochladen und mit Freunden oder gleich der ganzen Welt teilen.
It’s not a question of being a geek, but securing your entire supply chain. If you don’t already vet container image layers and cosigning said containers, chances are you’re already in risky rivers all the same.
In essence the rooted mode was never that big of a risk when compared to the actual runtimes. Certain attacks don’t even care about being in a user container if it deals with breaking the kernel itself, even with SELinux and AppArmor taken into account.
Rootless containers aren’t a magic bullet as a result. The only thing that you should concern yourself with is what you’re pushing to prod, how you layer your images and cosigning so that you can source… every mess… to every desk jockey junior…
Indeed. Also, I am concerned about self-hosting enthusiasts that install docker (without the advance rootless mode) and blindly run containers. Sometimes these containers are even made by third parties, independent of the app developers. Unfortunately, the supply chain there is up for grabs…
It’s not a question of being a geek, but securing your entire supply chain. If you don’t already vet container image layers and cosigning said containers, chances are you’re already in risky rivers all the same.
In essence the rooted mode was never that big of a risk when compared to the actual runtimes. Certain attacks don’t even care about being in a user container if it deals with breaking the kernel itself, even with SELinux and AppArmor taken into account.
Rootless containers aren’t a magic bullet as a result. The only thing that you should concern yourself with is what you’re pushing to prod, how you layer your images and cosigning so that you can source… every mess… to every desk jockey junior…
You…
Do not…
Mess with my infra.
Indeed. Also, I am concerned about self-hosting enthusiasts that install docker (without the advance rootless mode) and blindly run containers. Sometimes these containers are even made by third parties, independent of the app developers. Unfortunately, the supply chain there is up for grabs…