In this post we’ll be discussing the topic of Docker and how this could be used to target developers. Most readers will know what docker is, but for those who don’t know, Docker is simply a platform in which to allow applications to be packaged up into a container. These containers are isolated from one another and contain the application and all the necessary components needed to run the application.


Images can be created from these containers which allows for the transferring to other hosts without the application being affected. There is a repository of Docker images Docker Hub which is where the images are downloaded when using “docker pull” command for instance. Individuals across the globe download images every day, however, what would happen if a container image was only setup to comprise one or many organisations?


When viewing Docker Hub there are two main options that can be selected: Official Image and Verified Publisher. These will indicate there will be some authenticity behind the images. For example, here are two images that have these options:

Docker screen grab


However, not all images have these tags. So, if a malicious image was downloaded and used by a developer to maybe get a sprint completed in time because creating their own would take longer, the potential risk this could introduce may be high.


An example of this would be if an image was used and then introduced into an organisation’s infrastructure but was in fact backdoored allowing a malicious user to access the container. This may seem to be a theoretical idea; however, this was discovered in 2018 here, and some of these were downloaded more than one million times.


Being able to download pre-made containers might seem to be a great idea, but this is can introduce a huge risk. Containers which are used that do not have the tags “Official Image” or “Verified Publisher” should have verification carried out before they are used. Otherwise, provide enough time and resources for containers to be built in-house.

Join us in a partnership founded in research, education and execution

Our success is built on protecting our clients’ success. We have a distinguished track record of supporting our clients in building secure by design environments. Our consultants have successfully ushered in new security practices in leading pharmaceutical, energy and retail institutions. Bramfitt has over 50 specialists around the world and we are committed to forging long-term relationships with our clients, providing them with genuine insight and practical advice, and supporting them as they navigate the everchanging security landscape.

Let us be your partner for the next phase of your security journey.

EMEA Headquarters
Tower 42, 25 Old Broad Street London, EC2N 1HN
+44 (0) 208 187 4234
AMER Headquarters
45 Rockefeller Plaza, 20th Floor New York, NY 10111
+1 (800) 468-6046
APAC Headquarters
96 Wanneroo Rd, Yokine WA 6060, Australia
iasme consortium
iasme consortium
cyber essentials
cyber essentials plus
iot security assured
ukas iso 9001ukas iso 27001
Back to top
Get in touch