Upload pipeline-service images to multiple repos
bnallapeta opened this issue · 2 comments
bnallapeta commented
- Currently, we are storing our images in quay.io.
- Short names for container images comes with the potential risk of an outsider uploading an image with the same name in another image registry which could be a potential security threat at the user's end.
- If we don't claim redhat-pipeline-service on ghcr.io and docker (other image registry?), someone could claim it, push tainted images there, and an unsuspecting user doing a pull docker redhat-pipeline-service/setup_compute:latest could open themselves to harm.
- In order to avoid this, we need to upload our images to multiple image registries.
- https://www.redhat.com/sysadmin/container-image-short-names
- https://www.redhat.com/en/blog/be-careful-when-pulling-images-short-name
Roming22 commented
@ramessesii2 We've decided against uploading our images to other registries, but we've secured access to some organizations on various image registries to prevent that type of squatting.
Do you think that's good enough to close this issue?
bnallapeta commented
@Roming22 @ramessesii2 Yes, we have created orgs in other registries and that is good enough for now. Good to close this one.