Comments (6)
Hi @benmoss,
imgpkg
intentionally skips symlinks to ensure better security. I found the commit that reflects this decision, if you would like to take a look.
from imgpkg.
Fair enough, it's definitely possible for me to produce a directory with manifests that aren't symlinked, but not sure how this makes things more secure
from imgpkg.
Fair enough, it's definitely possible for me to produce a directory with manifests that aren't symlinked, but not sure how this makes things more secure
If you have a symlink that points back to the root of your disk, imgpkg
would be walking all the files and folders of your disk, which can become a security risk.
One option you have is to use multiple -f
flags and example:
❯ tree
.
├── assets
│ └── CarvelLogo.png
├── deployment
│ ├── config
│ │ ├── app.yml
│ │ ├── crds.yml
│ │ ├── helpers.star
│ │ ├── projects.yml
│ │ └── schema.yml
│ ├── prepare-env.sh
│ └── vendir.yml
├── tmp
│ ├── config
│ │ ├── images.yml
If you want to add multiple folders you could try to do
imgpkg push -b localhost:5000/test -f tmp -f assets -f deployment
dir: .
dir: .imgpkg
file: .imgpkg/images.yml
file: images.yml
file: images1.yml
dir: .
file: CarvelLogo.png
dir: .
dir: config
file: config/app.yml
file: config/crds.yml
file: config/helpers.star
file: config/projects.yml
file: config/schema.yml
file: prepare-env.sh
file: vendir.yml
Pushed 'localhost:5000/test@sha256:cebd982a00e726ac8eab35ade31c04e5c9f2c6226ac3285fd912f6471c83d764'
Succeeded
The only caveat here is that all the folder contents would be placed at the root of the bundle. Do you think this could help in your use case?
from imgpkg.
Yeah, in my case I was using symlinks to try to simplify the number of directories I would have to enumerate from vendored dependencies. I wanted to get my project to just be able to do to
imgpkg push -b localhost:5000/test -f config
config/foo -> ../vendor/dep1/foo
config/bar -> ../vendor/dep2/bar
vendor/dep1/foo <-- want this
vendor/dep1/bar <-- dont want this
vendor/dep2/bar <-- want this
I think maybe vendir can make this possible without symlinks.
from imgpkg.
You could also do
imgpkg push -b localhost:5000/test -f config -f vendor/dep1/foo -f vendor/dep2/bar
the only caveat would be that foo and bar would be present in the bundle at the root level.
from imgpkg.
For now, we are going to close this issue as a no-fix. Feel free to reopen this issue if you find other use cases that we should consider.
The major concern for us is always the security hazard that is associated with follow these symlinks to other parts of the disk (ex: /etc/passwd or other files).
from imgpkg.
Related Issues (20)
- Having the log implementation all internal causes friction when consuming imgpkg as a library
- Case when the registry link for pull is a image but the flags are -I along with —image-is-bundle-check flag=true which results in the image being pulled. HOT 5
- Are you using imgpkg?
- add ability to specify the select directories/files to be pulled/outputted. HOT 6
- Relocating bundle to Google Artifact Registry using `--repo-based-tags` fails HOT 1
- Sign `imgpkg` binaries while releasing them HOT 1
- imgpkg should emit plain text to be used in pipelines by default
- Add a limiter for pushing images HOT 3
- imgpkg miscalculates apache/nifi copy, produces corrupt image layer when copying apache/nifi in a bundle HOT 1
- Consider using OCI compliant media-types HOT 2
- imgpkg with flag --json swallows error
- Command `describe` does not include `metadata`. HOT 1
- imgpkg v0.40.0 breaks with relocated image HOT 2
- Imgpkg describe fails to print the output for the larger images HOT 1
- Update copyright headers
- Imgpkg describe fails to describe a bundle pushed to the repo
- Upgrade cosign version to latest version in GitHub workflows
- Cannot build for `GOARCH=386`
- Is there any way to disable progress bar shown during pushing of images ? HOT 5
- Bring tests against harbor back
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from imgpkg.