P.K. SHARMA

Cyber security intelligence, AI governance, practitioner analysis

Cloud and subscribed services

Container image store (container registry): what it is and how it is attacked

The library of packaged applications that machines fetch from whenever they start something.

Also known as

  • container registry
  • image registry
  • ECR
  • ACR
  • artefact store

Typing any of them into the editor finds this object.

Why it matters on a security diagram

Everything in it is trusted and run automatically, so changing what it holds changes what runs everywhere, without touching a single server.

How it gets attacked, and what reduces it

How it gets attacked

  • Permission to publish held far more widely than the few systems that actually publish
  • A label reused, so the same name quietly begins to mean different contents
  • Packages pulled from outside stores with no check on who produced them

What reduces it

  • Restrict publish rights to the pipeline, not to people
  • Refer to images by their content rather than by a label that can be moved
  • Verify the publisher of anything pulled from outside

Where it sits

Group
Cloud and subscribed services · Things that only exist because somebody else runs the platform underneath them.
Whose side, by default
Ours · Belongs to the organisation the diagram is about.
Catalogue identifier
container-registry

Reviewed . CC BY 4.0.

Others in cloud and subscribed services

The cloud and subscribed services group lists all 12 of them side by side.

Container image store on your own diagram

Open the editor, press N, and type container registry. The object is placed and connected to whatever was selected, and Tab adds the next one already joined to it. Nothing is uploaded: the page is served with a Content Security Policy that forbids the browser from making any outbound request at all.

Open the diagram maker