We have a private Docker Registry (Nexus) for our internal Docker images, https://company-docker-repo:8081. These images are never published to Docker Hub, they are for internal usage only.
Our images follow the following naming conventions:
company-docker-repo:8081/company/<repository>:<tag>.
A malicious person can upload a new (compromised) docker image company/<repository>:latest to docker hub and developers which pull company/<repository>:latest instead of company-docker-repo:8081/company/<repository>:<tag> now get the wrong image.
What can I do to prevent it?
- Is there a reserved
<repository>partial name to use, eg. "private/" or "internal/" prefix perhaps? - Are there conventions to follow to prevent this?