Does docker verify images? If so, how is it implemented? -


For me, a requirement for using dockkey in production will be the ability to verify that the images we use The pictures are actually the official "Ubuntu" or "Bizbox" images, I do not see any clear proof that the images are cryptographically signed on the public repository so that it can be verified that they are tampered Yes, is not. Am I missing something?

(As an alternative, I think it would be possible to start with scratch from our original images in our own personal registry, but still I have some checks in place that we accidentally have a public repo Do not drag anything from it.)

Docker "digital signatures verification", although it is still preliminary This verification ensures that anybody you download Dikarik image has not been tampered with in transit. At the time of writing, some official images need to work more with the files being downloaded during the image the construction process is checked properly against the stored hash.

You also want to see it.


Comments

Popular posts from this blog

import - Python ImportError: No module named wmi -

Editing Python Class in Shell and SQLAlchemy -

c# - MySQL Parameterized Select Query joining tables issue -