0

Although I never used an "imagization" tool (for example, Docker) I understand a container as an instantiated (running or stopped) image which in plural are simply put, a server environment and corresponding application/s, cloned from one computerized machine into another computerized machine (likely a virtual machine);
I further understand such cloning operations save time because application/s (and maybe also an OS) shouldn't be installed again and configured again to reach the state of the cloned machine, so one could start from the cloned state and make changes from there.

My problem

When I still used Facebook, I spoke there with some anonymous sysadmin who claimed something like he doesn't use imagization tools as an image could be contaminated with malicious software or hacked somewhere along the process without him knowing it.

I am not sure I enough understand what "imagization" tools are and the subsequent opinion I presented.

My question

Are there arguments against using “imagization" tools in the literature and if so, what are the main ones?

1

You might have better luck finding answers to your questions if you use the more standard term of "containerization".

This article discusses containerization as well as some pros and cons you might want to consider.

| improve this answer | |
1
+50

In my opinion, your real problem about this is getting incomplete data that didn't include image scanning, hardening and trusted registries.

Here are some first directions:

  1. The well curated Official Docker Images on DockerHub
  2. You can setup trusted docker registries and setup docker clients to evaluate these based on content trust.
  3. If you are planning to mirror images or publish some yourself based on others, you are able to setup docker image scanning

I only included links to the official docker doc links, but especially with "image vulnerablility scanning" there are a lot of free tools and services available as well.

Various (payed) solutions for the trusted registry are available in the cloud, eg: Azure Container Registry, Google Container registry or the JFrog Container Registry. With the later also available for on premises installation. The vulnerability scanning is as far is I know not included automatically.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy