As software supply Chain attacks have become an everyday threat, where bad actors poison a step in the development or distribution process, the tech industry has received a wake-up call on the need to protect every link in the chain. But actually implementing enhancements is challenging, particularly for the sprawling open source cloud development ecosystem. Now the security company chainguard says has a safer solution to a ubiquitous but long overlooked component.
“Container registries” are a kind of app store or clearinghouse where developers upload “images” of containers to the cloud, each containing a different software program. The cloud services you use every day constantly and silently browse container logs to access applications, but these logs are often poorly protected with only a password that can be lost, stolen, or guessed. This often means that people who shouldn’t have access to a particular container image can download it, or worse, upload images that could be malicious to the registry. Chainguard’s new container image registry aims to plug this esoteric but pervasive hole.
“Almost every possible bad thing has happened to container registries that you can imagine,” says Dan Lorenc, CEO of Chainguard and a longtime software supply chain security researcher. “People who lose passwords, people who introduce malware on purpose, people who forget to update things. The industry has just been using this for a long time – everyone was having fun, shipping the code, and no one was thinking about the long-term consequences.”
Chainguard researchers say they have long considered developing a more carefully designed registry, particularly one that does away with passwords and instead uses a single sign-on approach to control registry access. That way, a registry can be designed to be as accessible or as locked down as necessary, and only people who are signed in to other accounts, such as corporate identity services or Google accounts, and are then specifically authorized, will be able to interact with the registry.
“Container registries have been a weak link,” says Jason Hall, Chainguard software engineer. “They’re pretty boring, pretty standard. This is software that is based on software to deliver software. We need to do better and get rid of the passwords to talk to the registry so we can get into the registry.”
However, the big limitation to implement a system like this has been the cost. Running a container registry is often very expensive due to “exit fees”. In other words, cloud providers don’t charge enterprise customers to upload data to the cloud, but they do charge them each time someone downloads the data. So if container registries are like an app store where everyone comes to download container images, the egress fees can add up a lot real fast. This work discouraged review of the security of container registries because no one wanted to bear the cost associated with offering a more secure alternative.
The breakthrough for Chainguard came when Internet infrastructure company Cloudflare Announced the general availability of its R2 Storage service in September. The goal of the product is to offer low egress fees to Cloudflare customers and even no fees for infrequently downloaded data. Once R2 emerged as an option, Chainguard researchers had everything they needed to move forward with a more secure registry.