HN Explorer

Ask HN: would you trust a company's container images or repos after a breach?

11 points by riyakhanna1983 ↗ HN
Being a recent victim, let's take Nvidia as an example. Would you trust Nvidia's repos on GitHub or Container images? If no, how would you go about checking for any malware/backdoor? Any pointers would be appreciated. Thanks!

2 comments

[ 3.0 ms ] story [ 19.2 ms ] thread
orf
It depends. Usually the Dockerfiles are on GitHub anyway and you can take a peek, but a lot of them probably just install binaries or packages hosted elsewhere by the company.

That’s a bit harder to audit.

johngalt
There must be a qualification process for anything that will be put in contact with a production environment and/or sensitive data. What a container validation process looks like depends on the type of organization and it's risk appetite.