This is why you don't blindly run Docker containers

[jamiesonbecker]

Docker containers aren't the only problem.. EC2 AMI's, random screensavers you found attached to emails from your friends, new binary software you installed for free 'from the internet', random chrome/firefox extensions, iphone/android apps, blank USB keys that you found lying on the ground near your workstation..

[mikeash]

One tricky one is copy/pasting shell commands from web pages. Even if you're sure the command it shows you is benign, it's relatively easy to make it so that what gets pasted is malicious. Paste into a safe place first and look at it there before you run it, don't just look at what's on the web page.

[jamiesonbecker]

On second look, this might be more benign than it first appears.

I spent about thirty seconds digging through the package and the net. The mentioned SSL certificates don't seem to exist in that repo or referenced in google, but I did find this package that appears to generate said certs for you. https://github.com/joemiller/joemiller.me-intro-to-sensu

So it looks like (again, quick read) you're installing your own self-signed certs, which wouldn't imply any significant security risk assuming the script creates the files securely etc.

[mistaken]

What's wrong with that? It seems that he generates a new certificate which is used for rabbitmq...

[lstamour]

I'm not sure either. This is the script run two lines earlier: https://github.com/joemiller/joemiller.me-intro-to-sensu/blo...

[wereHamster]

Exactly, look at line 31 of the same file.

[curun1r]

To be fair, that's almost the only part of that Dockerfile that isn't all sorts of wrong, though not in a security vulnerability sense. Seeing that many yum installs in their own RUN commands is a sure sign of a Docker newb.

[erkose]

What are we supposed to be worried about?

[zwischenzug]

Am curious as to how downloading docker containers is any less safe than adding an apt repository and apt-get installing?

[pja]

A .deb package can do whatever it likes during installation, so not much difference in reality.

[mdekkers]

it isn't

[mdekkers]

I don't really understand why people don't bother building their own containers. The process is trivial, and very scriptable. Somebody built a container you want to use? Grab the Dockerfile and DIY. You might even learn something in the process..

[lordsheepy]

Given the benign nature of the self-signed certs, we should restart the holy war that docker shouldn't contain supervisor. An excellent use of everyone's time

[AReallyGoodName]

What does the clean and generate script two lines above do?

If it does what the parameters suggest what's the issue here?