Hacker News new | ask | show | jobs
by rgoldfinger 2376 days ago
The same could be said for any use of docker images. Seems a little unfair to single out Github.
3 comments
reilly3000 2376 days ago
That's definitely true, but given the sensitivity of having access to private source and secrets I think its fair to call out a warning.
link
ericlewis 2376 days ago
couldn't a malicious docker image also be tooled to dump all of that stuff to an external destination?
link
reilly3000 2376 days ago
Absolutely. CI systems tend to get broad access to everything sacred. Giving that level of access to community code is risky in the least.
link
ZitchDog 2376 days ago
Totally agreed. However, when do we stop making this mistake? I think it's worth a callout when a large organization designs a dependency management system with such an obvious flaw on the "happy path".
link
mleonhard 2376 days ago
It should be possible to import specific docker imager versions into a private repository and use them for production.

With Gitlab.com:

https://docs.gitlab.com/ee/user/packages/container_registry/

https://docs.gitlab.com/ee/ci/docker/README.html

link