testcontainers / testcontainers/testcontainers-java
Images used in modules should be be pulled by digest and not by tag
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 8.7k
- Forks
- 1.9k
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 9
Description
Currently the images used in the test containers modules are being pulled by tag.
This has several disadvantages, the biggest one being a possible attack vector if the owner's account for those images in Docker is compromised.
I understand that users can override and pull whatever image they want but it would be nice to have a more secure default.
I was going to submit a pr with these changes but I noticed that some images were already being pulled by digest before and this was changed to tags (example: #1406).
I want to know if there is interest in doing this. If so I can help. It's also unclear what kind of architectures are supported with Testcontainers (eg: arm?) which will influence the approach in case you feel like implementing this change.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the image references used across the test container modules and review the change described in issue #1406. Determine how supported architectures, including ARM, affect digest selection and the existing override behavior. Done means establishing a secure default that pulls module images by digest while preserving intentional user overrides.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, java
- Domain
- infrastructure, security, testing
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100