Building untrusted container images safely at scale

Comments (3)

adastra22 · 7h ago

I'm confused--what's the security risk in building a container?

Telstrom90 · 5h ago

You're running untrusted code. Every RUN command in a user's Dockerfile is executed during build, which means you're executing arbitrary commands from strangers on your own infrastructure. If you're not isolating that properly, it's a security risk.

adastra22 · 1h ago

Inside the container though. The whole point of which is that it sandboxes and isolates the running code.

Gemini CLI (blog.google)

U.S. bombs Iranian nuclear sites (bbc.co.uk)

Mechanical Watch: Exploded View (fellerts.no)

YouTube's new anti-adblock measures (iter.ca)

Samsung embeds IronSource spyware app on phones across WANA (smex.org)

Writing toy software is a joy (blog.jsbarretto.com)

uv: An extremely fast Python package and project manager, written in Rust (github.com)

OpenAI charges by the minute, so speed up your audio (george.mand.is)

Harper – an open-source alternative to Grammarly (writewithharper.com)

Phoenix.new – Remote AI Runtime for Phoenix (fly.io)

A new PNG spec (programmax.net)

A new pyramid-like shape always lands the same side up (quantamagazine.org)

Fun with uv and PEP 723 (cottongeeks.com)

Backyard Coffee and Jazz in Kyoto (thedeletedscenes.substack.com)

Vera C. Rubin Observatory first images (rubinobservatory.org)

Git Notes: Git's coolest, most unloved­ feature (2022) (tylercipriani.com)

Man 'refused entry into US' as border control catch him with bald JD Vance meme (dublinlive.ie)

A new PNG spec (programmax.net)

Thnickels (thick-coins.net)

How I use my terminal (jyn.dev)

I wrote my PhD Thesis in Typst (fransskarman.com)

Microsoft suspended the email account of an ICC prosecutor at The Hague (nytimes.com)

-2000 Lines of code (2004) (folklore.org)

Define policy forbidding use of AI code generators (github.com)

Microsoft Edit (github.com)

What Problems to Solve (1966) (genius.cat-v.org)

Hurl: Run and test HTTP requests with plain text (github.com)

Starship: A minimal, fast, and customizable prompt for any shell (starship.rs)

TPU Deep Dive (henryhmko.github.io)

PlasticList – Plastic Levels in Foods (plasticlist.org)

Klein Bottle Amazon Brand Hijacking (2021) (kleinbottle.com)

Writing a basic Linux device driver when you know nothing about Linux drivers (crescentro.se)

LibRedirect – Redirects popular sites to alternative privacy-friendly frontends (libredirect.github.io)

Tell HN: Beware confidentiality agreements that act as lifetime non competes

uBlock Origin Lite Beta for Safari iOS (testflight.apple.com)

Games run faster on SteamOS than Windows 11, Ars testing finds (arstechnica.com)

Fairphone 6 is switching to a new design that's even more sustainable (androidcentral.com)

Finding a 27-year-old easter egg in the Power Mac G3 ROM (downtowndougbrown.com)

U.S. Chemical Safety Board could be eliminated (ishn.com)

AlphaGenome: AI for better understanding the genome (deepmind.google)

Using Home Assistant, adguard home and an $8 smart outlet to avoid brain rot (romanklasen.com)

GitHub CEO: manual coding remains key despite AI boom (techinasia.com)

Puerto Rico's Solar Microgrids Beat Blackout (spectrum.ieee.org)

New Linux udisks flaw lets attackers get root on major Linux distros (bleepingcomputer.com)

Basic Facts about GPUs (damek.github.io)

MCP is eating the world (stainless.com)

Python can run Mojo now (koaning.io)

Getting ready to issue IP address certificates (community.letsencrypt.org)

AbsenceBench: Language models can't tell what's missing (arxiv.org)

Build and Host AI-Powered Apps with Claude – No Deployment Needed (anthropic.com)

Building untrusted container images safely at scale

Comments (3)

Git Notes: Git's coolest, most unloved feature (2022) (tylercipriani.com)