Hello! First, thanks for maintaining this incredibly useful tool.
Could you please start cryptographically signing the published Docker images? Providing a way for users to verify the images (such as using Sigstore/Cosign) would greatly reduce the risk of supply-chain and malicious container attacks.
Because this builder explicitly requires running with --privileged and -v /dev:/dev, the container inherently has root-level access to the host's entire device tree, including the host system's physical disk drives. Given this high level of access, giving users a way to verify the image's authenticity before execution is a critical security step.
Thank you for considering!
Hello! First, thanks for maintaining this incredibly useful tool.
Could you please start cryptographically signing the published Docker images? Providing a way for users to verify the images (such as using Sigstore/Cosign) would greatly reduce the risk of supply-chain and malicious container attacks.
Because this builder explicitly requires running with --privileged and -v /dev:/dev, the container inherently has root-level access to the host's entire device tree, including the host system's physical disk drives. Given this high level of access, giving users a way to verify the image's authenticity before execution is a critical security step.
Thank you for considering!