search

akbennett / lava-docker

Deploying LAVA in a docker image
6 stars 9 forks source link

lava-docker is insecure #7

Open akbennett opened 8 years ago

akbennett commented 8 years ago

The root password is "password" The lava superuser is "admin" with password "admin" There is a APIkey that is stored in the root of the docker image that is the same on other docker images.

fboudra commented 8 years ago

We shouldn't use the root user, but create maybe a lava user. We don't want to set a password but use an ssh key that can be mount as a volume by the user. I can send such example if you want to go this road (Linaro CI docker images doesn't contain credentials and it's the approach I use today)

fboudra commented 8 years ago

Here's the example: https://github.com/akbennett/lava-docker/pull/12