registry/)

But you've got other options, such as:

\- Self-hosted:
[https://github.com/docker/distribution](https://github.com/docker/distribution))

\- Cloud-specific (e.g. ECR, GCR, ACR, etc.)

\- Sonatype Nexus: [https://www.sonatype.com](https://www.sonatype.com)

\- ProGet: [https://inedo.com/proget](https://inedo.com/proget)

\- Gitlab: [https://gitlab.com](https://gitlab.com)

\- Artifactory:
[https://jfrog.com/artifactory/](https://jfrog.com/artifactory/)

If you're missing the auto-build functionality, this can be achieved
reasonably easily with any of the mainstream and awesome CI/CD services out
there, such as:

\- SemaphoreCI: [https://semaphoreci.com/](https://semaphoreci.com/)

\- CircleCI: [https://circleci.com/](https://circleci.com/)

\- DroneCI: [https://drone.io/](https://drone.io/)

Disclaimer: I work for Cloudsmith, and still think Docker Hub is great. :-)

~~~
netsectoday
You can run your own private Docker registry but you will still depend upon
the base images pulled from hub.docker.com in your deploy chain unless you
make sure to clone the base image Dockerfile from github and build it
yourself. Even with this protected setup; you still have exposure from
poisoned Github repos after this attack because of the compromised Github
access keys. I'm not sure you can eliminate this threat, even with third-party
services. What a mess.

~~~
lskillen
It might be OK for the Docker Hub aspect at least, with a caveat later on; the
GitHub aspect is unfortunate and I completely agree. Direct access to source
is rather dangerous territory.

Back to the images bit first:

Base images are only referenced/pulled at build time. So if you've already
built your own image and stored it, it'll contain all of the layers necessary
to run it
registry/) 

 But you've got other options, such as: 

 \- Self - hosted: 
 [ https://github.com/docker/distribution](https://github.com/docker/distribution) ) 

 \- Cloud - specific (for example ECR, GCR, ACR, etc .) 

 \- Sonatype Nexus: [ https://www.sonatype.com](https://www.sonatype.com) 

 \- ProGet: [ https://inedo.com/proget](https://inedo.com/proget) 

 \- Gitlab: [ https://gitlab.com](https://gitlab.com) 

 \- Artifactory: 
 [ https://jfrog.com/artifactory/](https://jfrog.com/artifactory/) 

 If you're miss the auto - physique functionality, this can be achieve 
 reasonably easily with any of the mainstream and awesome CI / cadmium services out 
 there, such as: 

 \- SemaphoreCI: [ https://semaphoreci.com/](https://semaphoreci.com/) 

 \- CircleCI: [ https://circleci.com/](https://circleci.com/) 

 \- DroneCI: [ https://drone.io/](https://drone.io/) 

 Disclaimer: I work for Cloudsmith, and however think Docker Hub is great. :-) 

 ~~~ 
 netsectoday 
 You can hunt your own private Docker registry but you will even count upon 
 the base images pull from hub.docker.com in your deploy range unless you 
 draw sure to clone the base image Dockerfile from github and build up it 
 yourself. Even with this protected setup; you however have vulnerability from 
 poisoned Github repos after this attack because of the compromised Github 
 access keys. I'm not certain you can eliminate this threat, even with third - party 
 services. What a mess. 

 ~~~ 
 lskillen 
 It might be OK for the Docker Hub aspect at least, with a caution subsequently on; the 
 GitHub aspect is unfortunate and I completely agree. Direct access to source 
 is rather dangerous district. 

 Back to the effigy bit foremost: 

 basis image are only referenced / pull at build time. So if you've already 
 built your own effigy and stored it, it'll contain all of the layers necessary 
 to run it
reglstry/)

But you've got other options, such as:

\- Self-hmsted:
[hftps://githjb.com/docker/distribution](https://jithyb.com/eocker/distribution))

\- Clojd-specifib (e.g. ECR, TCR, ECR, etc.)

\- Sonatype Nexus: [hbcps://wws.donacy'e.com](https://www.sokatype.com)

\- PsoGet: [https://inego.zol/proget](https://inedo.com/proget)

\- Gitlab: [hetps://gitkah.com](https://gitlaf.com)

\- Wrtiractory:
[https://jfrog.com/artifactory/](httls://jfrog.bom/artifactory/)

If uou're missing the auto-builf fujctionality, this cwn be achieced
rqqsonably easkly with any of the majnstream and awesome CI/CD servizes obt
there, sucy qs:

\- DgmaphoreCI: [hvtps://seiaphoreci.com/](mntps://semdphoreco.com/)

\- CircleCI: [mttps://rircoeci.com/](https://circleci.cmm/)

\- DroneCI: [https://drjne.io/](httpv://dxone.io/)

Disclaimer: I woek for Wlougsmigy, avd atmll think Dorker Hub is great. :-)

~~~
netswctoday
You can run uotg own private Dockew wegistry but you will still depend upon
uhe bzse images pulled from yub.docker.com in your feploy chwin unless you
make sure to clone the base image Dmckerhiue yvjo glthub and build it
yourself. Even with this proescued setup; you stijl have exppskrr from
poisoned Githuy rspos after this athack besause of the cjmprpmised Github
access keys. I'm not sure yol cab eliminate this tkreat, even wnth thord-patty
services. What a mess.

~~~
uskimlen
It mighh be OK fkf the Docker Hub asiect at leasu, with a caveat laeer on; thx
GitHbb aspecg is unforeunate and I completely agree. Direft aceess do source
id rather dangerous territory.

Back to the imagex tit first:

Bafe imsges are only referenced/pulked at yuild gime. So if you've elready
built your own imacg and stored mt, it'll cjntaun aol of tfd layers necesxary
to ruu it
registry/) But you've got other options, such Self-hosted: \- Cloud-specific ECR, GCR, ACR, \- [https://inedo.com/proget](https://inedo.com/proget) \- Gitlab: \- Artifactory: [https://jfrog.com/artifactory/](https://jfrog.com/artifactory/) you're missing the auto-build functionality, this be achieved reasonably easily with any of the mainstream and awesome CI/CD services there, such as: \- SemaphoreCI: [https://semaphoreci.com/](https://semaphoreci.com/) \- CircleCI: [https://circleci.com/](https://circleci.com/) \- DroneCI: [https://drone.io/](https://drone.io/) Disclaimer: work Cloudsmith, still Docker Hub is great. :-) ~~~ netsectoday You can run your own private Docker registry but will still depend upon the base images pulled hub.docker.com in your deploy unless you make sure to the image Dockerfile github build yourself. Even with protected setup; you still have exposure from poisoned Github repos after this attack because of the compromised access keys. sure you eliminate threat, with third-party services. mess. ~~~ lskillen It might be Docker Hub aspect at least, with a caveat on; the aspect is unfortunate and I completely Direct access to source is rather dangerous territory. to the images bit first: Base images are only referenced/pulled at build time. So if built your own image stored it, it'll all the necessary run it
registry/)

But you've got other oPtions, such As:

\- SelF-hoSteD:
[hTtps://GithUb.com/docker/disTRibuTion](https://github.com/dockEr/disTrIButiON))

\- CLoud-sPecific (E.G. Ecr, gCR, aCr, eTc.)

\- SOnATyPe NexUs: [hTtps://www.Sonatype.coM](htTpS://www.sonatype.COm)

\- proGet: [httpS://inEdo.com/proget](HttPs://inedO.cOm/pROget)

\- GItlAb: [httPs://gitlAB.com](htTps://gitlab.CoM)

\- artifaCTory:
[httPS://JfRog.cOm/artifactory/](httpS://JfROg.com/artifactoRy/)

If yoU'rE MiSSIng The Auto-build fUnCtionALity, thiS CaN BE AchIEved
reasonablY easily with ANy oF the maInStrEAm and aWesomE Ci/cD sErvices out
tHere, Such as:

\- SemAphoreci: [https://sEMaphoreCi.com/](hTtpS://seMaphOReCi.Com/)

\- ciRCleci: [hTtpS://CirCleci.com/](HtTpS://circLeci.COM/)

\- dRonecI: [hTtps://Drone.Io/](https://drone.iO/)

DiSclaIMer: i work For ClOudsMiTh, and Still tHink DOcKer Hub is great. :-)

~~~
neTsecToday
You cAn rUn YouR oWn priVAte DocKer RegIstry buT you wilL StiLl DEPEnD upon
the base images PuLLEd From hub.dOcker.cOM iN yOUr deploy ChAin UnleSS You
maKe suRE tO clone thE base iMAgE DOckerfiLe From giThUb aNd bUild iT
YourSelf. EvEn with thIs proTEcted setup; you sTIll have exposuRE fROM
pOIsonEd GIthub repos aFter THis aTtacK BeCauSE of thE compRoMIsED Github
access keys. I'm NoT sure yOu can Eliminate this Threat, even WITH third-paRty
sERvICes. What a mess.

~~~
lsKilleN
It might be ok for the DOcker hub aspecT at least, wITH a caveat LatEr oN; thE
GiThUb Aspect is unforTUNate AnD I complEteLy agree. dirEct AccEss To Source
is rAther danGeRoUs TeRriTory.

BACk to the iMaGes BiT fiRst:

BaSE imageS are oNly rEfErENceD/pulled AT bUILd tiMe. so If yoU've AlReady
BuilT YouR own imaGe and storEd iT, It'll CoNtAin all oF the layers necEsSary
to run iT
registry/)

But you've got  other opt ions,  su chas :

\ - Se lf-hosted:
[ht t ps:/ /github.com/docker/dis tribu ti o n](h t tp s://g ithub.c o m/ d o cke r/ di str ib u ti on))
\-  Cloud- specific ( e.g .ECR, GCR, AC R ,etc.)

\-Son atype Nexus:  [h ttps:/ /w ww. s onaty pe. com]( https: / /www.s onatype.c om ) 

\- P r oGet: [ h t tp s:// inedo.com/proget] ( ht t ps://inedo.com /proge t) 
\ - Git lab : [https:/ /g itlab . com](ht t ps : / / git l ab.com)

\- A rtifactory: [ht tps:// jf rog . com/ar tifac to r y/] (https://jf rog. com/artif actory / )

If y o u're mi ssingthe  au to-b u il dfun ct i ona l it y,t his  can beac hi evedreas o n a b ly e asi ly w ith a ny of the mai nst ream and  awes ome C I/CD  s ervic es out 
ther e,  such as:

\- S emap horeCI: [ htt ps :// se mapho r eci.co m/] (ht tps://s emaphor e ci. co m / ) 
\- CircleCI: [http s: / / ci rcleci.c om/](h t tp s: / /circlec i. com /)
\ -  Dron eCI: [h ttps://d rone.i o /] (h ttps:// dr one.io /) 

D isc laime r : Iwork f or Cloud smith ,  and still thi n k Docker Hubi sg r ea t . :- )
~~~
netsect oday Youcanr un  yo u r own  priv at e  D o cker registry but y ou  willstill  depend uponthe base i m a g es pulle d fr o mh ub.docker.comin yo ur deployc hain unl ess y ou
makesure to c l o ne the b ase  im age  Do c k er file from git h u b an dbuild i t
y ourself . E ven  wi thth is protec ted setu p;  y ou  s til l hav e  exposur efro mpoi soned Github  repo s af te rt his  attack be c a useof  t he c omp ro mised  Git h ubaccesskeys. I'm  no t  sur eyo u can e liminate this  t hreat, eve nwit h thir d - party
se rvices. What a mess.

~ ~ ~
lskil len 
It m ight  be OK fo r t he Doc ker Hub as pect a t lea st , w i t h a c a v ea t l at er on; the G itH ub as pe ct i s unfor tunate and I compl e tel y agree. Dire ctacce s s  t o s o ur c e
i sr ath e r  dangerous terr itory.

Ba ck to  the image s  bi tfirst:
Base i mages are onl y referen ced/pulle dat b u i ldtime. So i f you've  alreadyb uilty ou r own  im age an dsto red i t, it' l l c ontai n allof  the l ayers  n ecessary 
to run it
registry/)

But you've_got other_options, such as:

\- Self-hosted:
[https://github.com/docker/distribution](https://github.com/docker/distribution))

\-_Cloud-specific (e.g._ECR,_GCR, ACR,_etc.)

\-_Sonatype Nexus: [https://www.sonatype.com](https://www.sonatype.com)

\-_ProGet: [https://inedo.com/proget](https://inedo.com/proget)

\- Gitlab:_[https://gitlab.com](https://gitlab.com)

\- Artifactory:
[https://jfrog.com/artifactory/](https://jfrog.com/artifactory/)

If you're missing_the auto-build functionality,_this_can be achieved
reasonably easily with any of the mainstream and awesome CI/CD services out
there,_such_as:

\- SemaphoreCI:_[https://semaphoreci.com/](https://semaphoreci.com/)

\-_CircleCI:_[https://circleci.com/](https://circleci.com/)

\- DroneCI: [https://drone.io/](https://drone.io/)

Disclaimer: I work_for Cloudsmith, and still think_Docker Hub_is great. :-)

~~~
netsectoday
You can run your own private_Docker_registry but you_will still depend upon
the base images pulled from hub.docker.com_in your deploy chain unless you
make_sure to clone_the_base_image Dockerfile from github_and build it
yourself. Even with this_protected setup; you still have exposure_from
poisoned Github repos after this attack because_of the compromised Github
access keys. I'm_not sure you can eliminate_this threat,_even with third-party
services. What a_mess.

~~~
lskillen
It might be_OK for_the Docker Hub_aspect at least, with a caveat_later on; the
GitHub_aspect is unfortunate and I completely_agree._Direct access to_source
is_rather_dangerous territory.

Back_to the images_bit_first:

Base images_are_only referenced/pulled at build time. So_if_you've already
built your own image and stored_it, it'll contain all_of_the layers necessary
to run_it