0

I have Dockerfile for an image that I would like to publish to docker hub so it can be easily available to users without building the image themselves. The whole thing is meant for labbing and tutorial purpose, NOT production.

The container run from that image can be accessed by SSH using public key, for that, the public key need to be generated and placed in Dockerfile directory before exported to docker hub, without it dockerhub cannot build the image.

I would like to generate a separated key pair (public+private) from my PC, and make them both available for users. Of course the keypair is only for the image I am publishing.

Though each key pairs are different, is there any security risk for exposing the secret key?

Improve this question
1
  • Are you asking if there is any security risk with publishing a private key used for making an SSH connection into a ?public? repository in Github?
    – Neil Smithline
    Oct 5, 2015 at 2:18

1 Answer 1

Reset to default
2

Must assume key harvested on upload. Suggest first-run-script.

There seem to be bots that filter for Amazon EC2 keys on GitHub

Therefore I would assume that your RSA keys will be harvested by a similar bot. As soon as you upload the image.

The whole thing is meant for labbing and tutorial purpose, NOT production.

This has never stopped people from deploying.

If you want more peace of mind, then incorporate a technical antidote to this.

Like a first-run-script that does individual key generation upon first startup. (Either for SSH pubkey-auth or SSH password-auth.)

Improve this answer
1
  • Thanks for your reply StackzOfZtuff, I am proposing this solution if the image is manually built by users. The issue is that I would like to propose an already built image hosted in dockerhub. The keypair need to be generated before uploading github repository to dockerhub.
    – AJN
    Oct 5, 2015 at 13:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .