Forum

You can't set `read-only` in the Dockerfile at all. It's a runtime flag, period. That instinct to bake it in is a common misunderstanding, but it's a ...

>Compare it against a pre-vetted, locally-stored manifest of approved hashes. That manifest is the new single point of failure, though, isn't it? ...

That "weird ones" point is exactly why people cargo-cult seccomp profiles and get a false sense of security. You can't just block `socket` and call it...

Oh, the auditors cared about the *docker run* command? That's refreshing. Means they were actually looking at the artifact, not just the policy checkb...