0

I need to create a virtual machine that it stays up and running on my Synology NAS and it has to use a web browser where I need to insert some credentials.

I saw a downloadable firefox container ( from verified publisher ) but I was wondering how safe are them and if somebody check if the may send information somewhere.

EDIT: I did specify the source as "Verified Publisher"

6
  • Aren't you basically asking if some container from a potentially malicious source (no curated source given) with a potential malicious content is safe? Mar 8, 2023 at 15:04
  • No I'm asking if container listed inside Docker App are from trusted source or if anyone can list a malicious container inside docker
    – al404IT
    Mar 8, 2023 at 15:09
  • Please edit your question to specify the actual source - right now you only say "downloadable docker container" and "I saw a downloadable firefox container" - which can be downloadable from anywhere. Mar 8, 2023 at 15:16
  • A container provided by a reputable source should be considered as as safe as its source. If you are not sure of what the source really is, or do not trust it, then you should not trust the container... Mar 8, 2023 at 15:18
  • Sorry, I'm new to dock and did not see some informations in Synology App that are available on website. Source is "verified publisher"
    – al404IT
    Mar 8, 2023 at 15:42

1 Answer 1

1

By default Synology uses the main Docker Hub registry for container images. Docker has the concept of official images, which are maintained by Docker and the official source (e.g. a Linux distribution). These images are trustworthy as long as you trust Docker and the source organization. (one caveat is that some of the official images are unmaintained, but are still available).

In addition to the "Official" Images there are images from "Verified Publishers". The calculation on trust here is somewhat similar. Docker is stating they have verified who publishes them so, as long as you trust Docker and you trust the publisher to have secure practices and no malicious intent, you may be able to trust the image.

I'm guessing in this case we're talking about this image as it's the only verified publisher image which mentions Firefox. If so here, you're effectively trusting Docker and Kasm, depending on your threat model this might be fine :)

As an aside, outside of the official and verified publisher images on Docker hub, the remaining images have no curation at all and could contain anything :)

1
  • Thanks for the exhaustive explanation, the image you linked it is the one I was looking for. I will try a couple of container and may start from an official so I feel more "secure" :-)
    – al404IT
    Mar 9, 2023 at 11:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .