this post was submitted on 21 Oct 2024
44 points (89.3% liked)
Programmer Humor
19423 readers
128 users here now
Welcome to Programmer Humor!
This is a place where you can post jokes, memes, humor, etc. related to programming!
For sharing awful code theres also Programming Horror.
Rules
- Keep content in english
- No advertisements
- Posts must be related to programming or programmer topics
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Ah, my bad "again"... should have mentioned that there's the advance configuration option that 1% of the geeks do
It's not a question of being a geek, but securing your entire supply chain. If you don't already vet container image layers and cosigning said containers, chances are you're already in risky rivers all the same.
In essence the rooted mode was never that big of a risk when compared to the actual runtimes. Certain attacks don't even care about being in a user container if it deals with breaking the kernel itself, even with SELinux and AppArmor taken into account.
Rootless containers aren't a magic bullet as a result. The only thing that you should concern yourself with is what you're pushing to prod, how you layer your images and cosigning so that you can source... every mess... to every desk jockey junior...
You....
Do not...
Mess with my infra.