In 2015 I was running docker containers for a Gov organisation, where:
- docker containers were built from source
- Dockerfile published with the code
- Built in a new CI environment
- Pushed, Pulled and deployed from the sha
- Collecting network traffic, undertaking protective monitoring, that looks for those backdoors.
Just because you can pull arbitrary bullshit doesn't mean you have to.
Though for the record, the same sysadmins that whine about newer tools are generally the same ones that implicitly trust their older toolsets. Just because you can compile it, doesn't make it secure, so you need to be running monitoring solutions and hedging your bets no matter the tech.
- docker containers were built from source
- Dockerfile published with the code
- Built in a new CI environment
- Pushed, Pulled and deployed from the sha
- Collecting network traffic, undertaking protective monitoring, that looks for those backdoors.
Just because you can pull arbitrary bullshit doesn't mean you have to.
Though for the record, the same sysadmins that whine about newer tools are generally the same ones that implicitly trust their older toolsets. Just because you can compile it, doesn't make it secure, so you need to be running monitoring solutions and hedging your bets no matter the tech.