Architect
The poisoned mirror
The push account of our image mirror leaked (security/advisory.md). Until it is rotated at 03:00, anyone can overwrite registry.shop.internal/mirror/node:20-alpine or mirror/postgres:16 with a backdoored copy that works perfectly. Tonight the nightly job rebuilds and redeploys on the mirror's latest images. Make sure it can only ever use the images the shop runs on right now, and that it still succeeds.
You are on the production server. It reaches the company registry but not Docker Hub (outbound traffic is filtered). The test calls http://<server>/products every minute for two hours; at 0:20 someone pushes to the mirror with the leaked account; at 1:00 ops/nightly.sh runs. At the end, every running container is checked for injected layers.
What your server must hold
- security.compromisedImages = 0
- build.nightlyOk = 1
- Availability ≥ 99 %