I’ve started to pin my Docker containers to specific versions, which allows me to vet the “latest” release before I install it (check online for supply chain issues and such that are happening a lot recently).
This is all great but my lovely Dockhand update notifications don’t do anything anymore. Dockhand just assumes (probably rightly) that I’m on the version tagged so it’s good. I would like for it to inform me (even it the click-to-auto-update button isn’t available)
Anyone know a way to make Dockhand work with this? And failing that, have another tool that might work. I’ve used other update tools before moving to Dockhand such as What’s Up Docker (WUD) but don’t know if they can do it either. Can they?
And yes, of course I know I could monitor it via RSS, but I’m not asking that here.
Cheers.
1 Like
While I don’t know of any way to do this with current version of Dochand, I don’t think it’s the proper approach to avoid supply chain attacks. There is often a long delay in when these attacks happen vs when they are discovered. How do you know you are not pinning a compromised version?
1 Like
Ya I wouldn’t know, but the same as I wouldn’t know if “latest” had one either. Looking online it seems like a lot of the major ones are (very luckily) caught in the first few days, so a few days could be my buffer zone before I move onto it. On the flip side I’d have to of course make sure I don’t stay on too old of a version, or if a vlun is found in the tagged version to immediately rectify it.
It’s just a balancing act really to limit exposure to threats both from the latest releases and from being on too old of a release.
If a critical flaw was found on the tagged version I set and it was fixed in “latest” then I’d just move on, because most likely “latest” wouldn’t have a hidden flaw but the tagged version definitely has.