I am a junior web developer. All I know is mostly about web development. I have no skills and knowledge about system security and know little about Linux.
I work in a company which is developing some embedded product. In the R&D department, some developers built a build-server for development. They make our own Docker image and run Docker, including CI/CD and Gitlab service, in this server.
This build-server connects with our AD server. Our developer could add his own public Key to this server and then remotely log in to this server with SSH and doing development in this server. We call it DevOps.
This server only works in our company's intranet or VPN, not open for public Internet.
The above is all background information.
A few months ago I read some IT security blogs about Docker security issues. It says that because the architecture of Docker is different from traditional VM, if the Docker image is backdoored, then the whole system will be easily hacked.
If I suppose that the person who built this build-server is not a good guy, and he backdoored the Docker images, is it possible that my account in this build-server could be hacked or usurped?
I mean even I use the public key and SSH login, without typing the password manually. Does this risk still exist?
Second question: if the first question above is TRUE, what could I do to protect my self?
I mean, if the bad guy usurped my account and did something bad thing (for example, leaking development codebase of company using my account or doing other attacks using my account), how could I prove I am innocent?
I can not discuss these suspicions thinking with my colleague because I have no evidence about those things. I just worry about these becoming true, so I want to do something to prevent, just in case. I also have no authorization to check or validate the server.
What could I do? Backup my login logs of my laptop periodically? (But it seems irrelevant to the build-server.)