Pipe data through notary to docker load about imagewolf HOT 5 CLOSED

Yes, good point. Currently, I think this a little advanced for this PoC, but I'll leave the issue open for the future.

Also, note that docker load probably isn't the right way to do things in the long term. Looking at the issue tracker for quayctl, they found docker load caused high CPU and mem usage so instead moved to a model where they did a docker pull from a local registry that was temporarily instantiated.

from imagewolf.

I guess there'd still be an issue even though docker pull uses notary if enabled: When pulling from a local repo, the GUN would not be the same as when pulling directly from the origin repo. It would then still end up being ImageWolf's task to verify the hash of the content, probably before making it available from the local repo.

Correct. You could also simply do a hash lookup using notary and verify if the file matches (which is what notary verity does)

https://twitter.com/diogomonica/status/878842915463716864

from imagewolf.

Yeah, I figured there would be problems like that.

For a production version we'll need to think through the different levels of provenance and potential attacks. I suspect it's just the initial pull/load that needs notary, after that we should be able to distribute everything via checksums, but I may be making too many assumptions.

There is a problem currently whereby an attacker can get ImageWolf to download and distribute any image by just knowing the URL to contact it on.

from imagewolf.

I suppose I'll just leave this issue hanging around in case anyone picks up on the PoC, but feel free to close it if it's out of scope anyway.

from imagewolf.

Yes, let's leave it open. Thanks for the interest - feel free to send me an e-mail if you have any questions or feedback!

from imagewolf.