Remove the docker hub as a registry and only use the mirror for searching for images?

[rajbos]

From a security perspective I'd want to limit the use of non-checked images from for example docker hub and only allow images from our own container repository. Is there a way to do that?

I guess I can use the dockerRegistryMirror setting so that the containers will always be search for in our own registry, but if the image is not found it would check the docker hub and still use the image from there, right?

I can limit the connection to docker hub on the cluster level, but rather have it looking only at the right place.
Of course people can then still use a registry login action and try to get the container from elsewhere. I'm trying to get the default setup right so we can guide the users to success :-).

[toast-gear]

I guess I can use the dockerRegistryMirror setting so that the containers will always be search for in our own registry, but if the image is not found it would check the docker hub and still use the image from there, right?

I'm not sure without testing tbh

This project however isn't looking to take an opinionated view on what is the "right" registry source, for many organisations Docker Hub is seen as perfectly an acceptable image source. As a result this request is outside of scope for this project. You would need to do this level of filtering on your cluster or LBs or enforce signed containers only etc

[rajbos]

So we need to lock things down using a Pod Security Policy or the new Open Policy Agent on the cluster/namespace level then? That makes sense as well and puts this question outside the scope of this project.

[toast-gear]

I'm not sure you could do this with pod security or open policy agent config? The Open Policy Agent stuff would just apply to the admission hooks and docker daemon of the node, not the docker daemon within the runner container or dind sidecar container itself (depending on the runner you use)? I think you would need to do this sort of thing with a firewall change tbh or produce a custom runner and blackhole the DNS entries that are for Docker Hub:

https://auth.docker.io
https://registry-1.docker.io
https://index.docker.io/
https://dseasb33srnrn.cloudfront.net/
https://production.cloudflare.docker.com/

People have tried to convince Docker Inc many times to support blacklists for registries in docker itself but the issues always get closed e.g moby/moby#11819 so I don't think there is anything you could do with Docker directly.

https://github.com/open-policy-agent/opa-docker-authz I did find a open policy agent plugin for docker which looks like it will allow you to extend open policy rules into the runner's available docker daemon but I've never used it before and it doesn't look the most alive of repositories

[mumoshu]

@rajbos You'll need more broader and comprehensive solutions depending on your requirement. For me, talking about PSP, OPA, docker registry mirror only doesn't seem to improve the security in a meaningful way.

What if the user runs docker load to load the arbitrary image into dockerd?

Not only using docker registry mirror thing to narrow the communication path and using PSP or OPA to apply policies to block unwanted images to be used in pod spec, you'll also need some more work, so that any user can't bypass anything.

More concretely, you might need to use L4 or L7 network policies thing like Cilium or Istio or DeepSecurity or whatever, and/or Sysdig/Falco for limiting running docker-load, or whatever, depending on your use-case.

That said, I think this is out of the scope of this project. No k8s controller maintained by the community I know of provides comprehensive security solutions that are free of charge. I hope I could do it, but that's not practical.

I'm open to accepting concrete patches to enhance the default security posture of the project, though, if possible.

[rajbos]

Thanks, learnt something new :-). Definitely out of scope this project indeed.