search

OWASP / Docker-Security

Getting a handle on container security
https://owasp.org/www-project-docker-top-10/
Other
625 stars 130 forks source link

Add Introduction to D06 #37

Closed Aut0R3V closed 3 years ago

Aut0R3V commented 3 years ago

I felt like there could be a little bit of work done here. Please add in any comments of changes. I'll add in more stuff soon if PR's are accepted here.

Aut0R3V commented 3 years ago

@drwetter @wurstbrot

drwetter commented 3 years ago

Hi @Aut0R3V ,

thanks!

The introductory section though should rather give a broad with an overview. Also I would like to avoid the term 'docker secrets' here as it was/is used in correlation with docker swarm. Also docker swarm is listed specifically there.

So everybody else not using docker swarm will scratch their heads what this will be about.

The first paragraph should contain as a very first thing a definition what a secret is. Also it's not only about keys or certificates about secure transmission. The transmission can also be clear text, also when it maybe discouraged from using it. E.g. as a matter of fact, often it -- when using a DB connector.

I'll try to make a counter suggestion (=PR) the next few days.

Aut0R3V commented 3 years ago

@drwetter actually I wanted to know if PR's are being accepted. I can add a proper introduction with the added comments. I'd also like to work on the other sections in D06.

drwetter commented 3 years ago

To add: The introductory section should always be high level. If we start with low level tech stuff there we loose people upfront

Aut0R3V commented 3 years ago

Sure thanks! I'll send in a commit soon.

drwetter commented 3 years ago

PR #38 is not superb but it's definitely closer to what I think it should be like. So I am closing this one.

Feel free comment on #38 or send in PRs to the d06_intro branch