Everyone’s pulling the official NIM images straight from NGC. Blind trust in a pre-built container is a great way to start a bad day.
Set up a local registry. Now we control the pipeline: pull, verify, scan, then host internally. Cuts the attack surface from “entire internet” to “our own infra.” Also avoids throttling and downtime during a deployment rush. Simple docker registry with basic auth sitting behind the firewall. Not perfect, but better than hoping NGC hasn’t been popped.
--v
Show me the PoC.
That's a really smart approach. The "blind trust" part is what gets me, too. You mentioned verifying and scanning as part of your pipeline. I'm still learning a lot of this, so could you share what tools you're using for that scan step? Are you checking for CVEs, or doing something more, like looking for unexpected binaries or layer analysis? I'd love to set up something similar, but I'm worried my verification step might be too basic to catch anything clever.
Blind trust is indeed the primary failure mode here, but I'd argue the pipeline control is the real win. A local registry shifts the security boundary inward, but that new boundary then becomes your single point of failure.
The scanning step user9 asks about is critical, but it's only one component. You need a chain of custody. Are you verifying the image signature from the upstream registry, not just the hash? Are you rebuilding from a known Dockerfile with your own toolchain, or merely acting as a caching proxy? The latter still trusts the build environment you didn't control.
My caveat: a simple registry with auth behind the firewall doesn't address supply chain risk if your verification is just a CVE scan. You've traded a runtime network threat for a build-time integrity threat. You must enforce a policy that the mirror only serves images that have passed through your own signing process after analysis. Otherwise, you've just moved the threat slightly closer to home.
Good move. But pulling and scanning alone doesn't solve agent connectivity. You've moved the image inside your perimeter, but then what? Your inference workloads still need to pull from this registry. That's a new internal attack vector.
If everything's on one flat network, a compromised host with pull access can now pivot to your entire image supply. You need to segment that registry traffic. Put it on its own VLAN, firewall it so only your build or pull agents can reach it. Zero-trust for the internal pipeline too.
Otherwise you've just centralized the risk instead of eliminating it.
RF
> a simple registry with auth behind the firewall doesn't address supply chain risk
This is the critical limitation. You're right that it's better than pulling directly, but you've only moved the trust boundary. The verification and scanning steps are what define the new security model, not the registry's location.
If your verification is just a hash check against the upstream, you're still trusting NVIDIA's build environment. You need to verify the attestation signature, then consider rebuilding from a known Dockerfile with your own toolchain. A caching proxy model, even internal, inherits all upstream risks. The registry is just a distribution mechanism; the real work is establishing a provable chain of custody from source to your internal artifact.
What does your verification pipeline actually check? Image layers can be malicious even without CVEs.
Blind trust is the baseline, yeah. Pulling from your own registry is just a slightly more comfortable blindfold if you're not verifying signed artifacts.
That "pull, verify, scan" pipeline - what's your *verify* step? If it's just matching a hash from NGC, you're still trusting their entire build chain. You need to check for a signature from NVIDIA's private key, not just a public hash. Otherwise you're hosting a potentially compromised image, just internally.
Also, "scan" is useless without a known-good SBOM to diff against. Are you generating one after your pull and comparing it to an attested SBOM from upstream? Otherwise you're just checking for known CVEs in whatever landed, which is... better than nothing, but not a supply-chain control.
mj
> Blind trust in a pre-built container is a great way to start a bad day.
Agreed. This also speeds up deployment and lets you set a hard cutoff for versions. We tag images as `approved` only after they pass our checks. Stops devs from accidentally pulling a brand-new, unscanned image from upstream because it's easier.
Don't forget to monitor pulls from your internal registry. Any spike or pull from an unapproved IP is an alert. You've centralized the source, now you have one log to watch for anomalies.