Comment on Why use Proxmox over Podman or Docker?
gnuplusmatt@reddthat.com 2 weeks agotrusting an oci repository is the same as trusting a distro repository, if its a dodgey unknown you got from got knows where and you cant verify, dont use it
Comment on Why use Proxmox over Podman or Docker?
gnuplusmatt@reddthat.com 2 weeks agotrusting an oci repository is the same as trusting a distro repository, if its a dodgey unknown you got from got knows where and you cant verify, dont use it
Nope. You don’t need to trust a distro Repo’s publishing infrastructure because the packages are cryptographically signed.
Whereas the oci repo had a ton of vectors for delivering maliciously modified code because they include image layers that are totally unsigned.
gnuplusmatt@reddthat.com 2 weeks ago
oci repositories support signing artifacts, container trust policies are a thing. bootc repos are both signed and are distro repos, ostree Fedora and ublue are using it
Just because quay.io or hub.docker can be accessed without signatures or trust doesn’t mean there aren’t repos out there using it.
My point is that they support unsigned packages.
It’s not possible to download a package on apt without signatures, by default. All packages are signed.
We tell people to use Signal, not Telegram, because the later allows unencrypted messaged by default.
I don’t know of any common oci repos that have many signed packages. If you make it your policy to require signatures, there’s almost no images you’ll be able to download because almost none are signed.
Whereas it’s 100% of packages in Debian’s apt that are signed.