The result of the study can be found at https://arxiv.org/pdf/2307.03958.pdf.
The amount of the internet and cloud infrastructure that is built on public Docker images makes this… worrying.
Isn’t it about people pushing their keys to public? I feel like this doesn’t affect the pulling side
Of course. In my opinion, what Docker is used for on Hub is a different model than it was originally supposed to solve. It was designed as a solution for enterprise where the development team had no easy control over the production environment, so the solution was to bundle the platform with the software. However, your production team is usually trustworthy, so leaking secrets via the container isn’t an issue (or actually sometimes you wanted the image to include secrets).
The fact that Hub exists is a problem in itself in my opinion. Even things like the AUR - which comes with its own set of problems - is a better solution.
nix provides a solution to build clean Docker images. But then again it only works for packages that are either in nixpkgs already or you have written a derivation for, the latter being probably more effort than a quick and dirty dockerfile.
The stufy link isn’t working for me.
