Add info about the shared image registry (#1885)

Signed-off-by: Grant Linville <grant@acorn.io> Co-authored-by: Craig Jellick <craig.jellick@gmail.com>
acorn-io · Jul 6, 2023 · d591c99 · d591c99
1 parent 36e45cb
commit d591c99
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/docs/docs/60-architecture/02-security-considerations.md b/docs/docs/60-architecture/02-security-considerations.md
@@ -76,6 +76,14 @@ acorn:project:view
 acorn:project:view-logs
 ```
 
+### Shared Image Registry
+
+Default installations of Acorn Runtime will deploy an OCI registry into Kubernetes, which will be the default image storage for all projects.
+This registry is not secured with credentials.
+Acorn's API server performs basic checks to try to prevent users from trivially accessing images that belong to other projects, but this is not guaranteed.
+
+You can configure Acorn to use an external OCI registry, but the credentials are shared between all projects, so the security implications around image access are the same. Future releases will improve upon this by providing a framework for isolating registries.
+
 ## Credentials
 
 Credentials refer to credentials used to pull from and/or push to OCI registries.