Add information on security - Githubissues

o2r-project / erc-spec

Executable Research Compendium specification and guides

https://o2r.info/erc-spec/

Creative Commons Zero v1.0 Universal

7 stars 5 forks source link

Add information on security #61

Open nuest opened 6 years ago

nuest commented 6 years ago

Add a "Security considerations" section to the spec?

Or at least document in the developer guide: Why are ERC not a security risk?

Take a look at https://tools.ietf.org/html/draft-kunze-bagit-14#section-6

Reasons:

the spec prohibits use of EXPOSE
the containers are only executed without external network access using Network: none, see Docker CLI run documentation