So, this has always bugged me. How do you validate a Docker container? No one wants to pull a laced up container, so there has to be a way one can check. Of course, sticking to original docker containers from Docker Hub would be one method I suppose. Is there some kind of scan one can do? I do this on my Windows computer; scan before installing. Besides looking at code that I would have no idea what is going on, what protocols do you guys use?

  • rumba@lemmy.zipEnglish
    2·
    16 hours ago

    I suspect somebody could do some damage if they managed to infiltrate one of the reverse proxy containers. That might net you some useful credentials from the home gamers as they’re doing the HTTPS wrapping themselves.

    Any container that gets accessed with a web browser could potentially contain zero day exploits, But truth zero days with a maximum CVE value are rare.

    • usuarioimanol@lemmy.worldEnglish
      1·
      10 hours ago

      I have ports controlled but I use containers with http, however it is not exposed to the WAN, only to the LAN, is it equally risky?

      • rumba@lemmy.zipEnglish
        2·
        6 hours ago

        If you’re not open to the wan, you’re in decent enough shape.

        The bar in your situation is that someone would need to shove a ransomware payload into a JavaScript 0-day for a package in your container without anyone noticing it, you’d have to update your container with it, then visit it with a vulnerable internet-connected computer. It’s not impossible, but a really long, long shot.