I've recently been examining the possibility of using containers for node applications.
Ideally I would like to use --disable-content-trust=false when consuming images. This works when downloading alpine (i.e. I get the same image when I docker pull --disable-content-trust=false alpine as when I docker pull --disable-content-trust=true alpine).
However, this does not work for node:alpine. When I docker pull --disable-content-trust=false node:alpine I get a 13 month old image with vulnerabilities (according to snyk), with docker pull --disable-content-trust=true node:alpine I get one only eight days old.
It seems this is a known issue and docker is somehow involved in it being broken (being that node is an official image). I've not done too much of a deep dive.
https://github.com/nodejs/docker-node/issues/1065 https://github.com/docker-library/official-images/issues/6838
My question to anyone happily using docker images from hub, are you solely relying on the sha256 checksums that occur on download or are you sticking to using images where content-trust works and building up from there yourself? (maybe this belongs better on software engineering? if so apologies)
I know that largely this depends on your threat model, but still interested!