Because of course they are.
The more interesting question is, how many downloads do they get?
So without those numbers, I see this as largely FUD. It doesn’t seem like trusted repos are getting infiltrated, so this sounds like a nothing burger. It’s good that Docker removed them, but without actual evidence of harm, it just seems cosmetic.
As of this writing, I saw one comment:
I get all kinds flack for not using docker containers and this is why I don’t. 20% is 1 in 5 containers, that cannot be trusted. I have no desire to to build my own Docker containers. I would much rather spin up a VM. CPU, RAM and disk space are cheap these days.
- Throwdown
This entirely misses the point of Docker. Yeah, 1 in 5 containers have malware, but how likely are you to be mislead into using one of those containers? I only pull containers based on some official project.
For example, if I want to host nextcloud, there’s an “official” image for that. For CI, I generally use images from “official” sources (e.g. this one from Rust for Rust projects).
Then again, I’m a developer, but I don’t see anything here about Docker itself being a problem, and the vast majority of users will probably just follow links from some blog to accomplish some task, they won’t be downloading random images from the Docker hub…
This entirely misses the point of Docker.
It’s just pointing out the risk of letting someone you don’t know with no legal obligations setup your complete environment.
How likely
Probably as likely as someone cracking your really secure ssh password. Still, any sane expert will recommend disabling password auth.
I only pull containers based on some official project.
How do you know they weren’t compromised?
but I don’t see anything here about Docker itself being a problem
The problem is that rootless docker is a pain and no one does it. Privileged software sideloading other software is a huge risk.
That risk now became an incident. Even if you’re not affected, the risk still remains.
How do you know they weren’t compromised?
I don’t think that’s possible to know definitively, but I will say that this research doesn’t indicate that any images or repositories were compromised, only that a bunch of malware-ridden images were pushed to new repositories. In other words, it’s like they’re implying Google Drive is compromised because someone uploaded malware to their own account and are sending links to it. AFAIK, there wasn’t an attack on Docker as a platform or any existing repositories, these are just new repositories set up to host malware.
The proper mitigation here is to inform users how to find “official” images and repositories. Pulling a Docker image is like downloading any form of software, make sure you trust the source before pulling it down.
The problem is that rootless docker is a pain and no one does it
Nobody does it because it’s generally not necessary.
The reason to run system services as non-root is because there’s no sandbox to keep you safe. Docker provides that sandbox. Yeah, rootless containers are better security-wise since it provides another level of protection, but just using any sandbox follows the Pareto principle (80% benefit for 20% effort). Yeah, you probably should use rootless containers, but the focus should be on making sure the configuration for the container doesn’t expose more than necessary.
The following needs to happen for a user to be impacted:
- download untrusted docker image - similar to downloading random executables from the internet
- configure untrusted docker image with way more access than is necessary - as in, essentially eliminate the sandbox
- run the container on a system with valuable data on it w/o backups - production systems should separate data from applications (i.e. mount points, S3-like buckets, etc), and development systems should have backups
There’s no Docker vulnerability here, so the title is unnecessarily alarmist. Docker hub is still absolutely safe to use, just make sure you trust the repositories and images you use.
