So, this has always bugged me. How do you validate a Docker container? No one wants to pull a laced up container, so there has to be a way one can check. Of course, sticking to original docker containers from Docker Hub would be one method I suppose. Is there some kind of scan one can do? I do this on my Windows computer; scan before installing. Besides looking at code that I would have no idea what is going on, what protocols do you guys use?

  • usuarioimanol@lemmy.worldEnglish
    1·
    10 hours ago

    I have ports controlled but I use containers with http, however it is not exposed to the WAN, only to the LAN, is it equally risky?

    • rumba@lemmy.zipEnglish
      2·
      6 hours ago

      If you’re not open to the wan, you’re in decent enough shape.

      The bar in your situation is that someone would need to shove a ransomware payload into a JavaScript 0-day for a package in your container without anyone noticing it, you’d have to update your container with it, then visit it with a vulnerable internet-connected computer. It’s not impossible, but a really long, long shot.