As software supply chain attacks have emerged as an everyday threat, where bad actors poison a step in the development or distribution process, the tech industry has had a wake-up call about the need to secure each link in the chain. But actually implementing improvements is challenging, particularly for the sprawling open source cloud development ecosystem. Now, the security firm Chainguard says it has a more secure solution for one ubiquitous but long-overlooked component.
“Container registries” are a sort of app store or clearinghouse where developers upload “images” of cloud containers that each hold a different software program. The cloud services you use every day are constantly and silently navigating container registries to access applications, but these registries are often poorly secured with just a password that can be lost, stolen, or guessed. This often means that people who shouldn’t have access to a given container image can download it or, worse, they can upload to the registry images that could be malicious. Chainguard’s new container image registry aims to plug this esoteric but pervasive hole.
“Pretty much every bad possible thing has happened with container registries that you can imagine,” says Dan Lorenc, Chainguard’s CEO and a longtime software supply chain security researcher. “People losing passwords, people pushing malware on purpose, people forgetting to update stuff. The industry has just kind of been using this for a long time—everyone was having fun, shipping code, and nobody was thinking about long-term consequences.”
The Chainguard researchers say they have long considered developing a more thoughtfully designed registry, particularly one that gets rid of passwords and instead uses a single sign-on approach to control registry access. That way, a registry can be designed to be as accessible or as locked down as needed, and only people who are logged into other accounts, like corporate identity services or Google accounts, and then specifically authorized can interact with the registry.
“Container registries have been a weak link,” says Jason Hall, a Chainguard software engineer. “They’re pretty boring, pretty standard. This is software that’s relying on software to deliver software. We need to do better and get rid of passwords to talk to the registry and be able to push to the registry.”
The big limitation on deploying a system like this, though, has been cost. Running a container registry typically gets very expensive because of “egress fees.” In other words, cloud providers don’t charge enterprise customers to upload data into the cloud, but they do charge them every time someone downloads the data. So if container registries are like an app store where everyone is coming to download container images, the egress fees can get really big really fast. This disincentivized work on overhauling the security of container registries because no one wanted to take on the cost associated with offering a more secure alternative.
The breakthrough for Chainguard came when the internet infrastructure company Cloudflare announced the general availability of its R2 Storage service in September. The goal of the product is to offer reduced egress fees to Cloudflare customers and even no fees for data that gets downloaded infrequently. Once R2 emerged as an option, the Chainguard researchers had everything they needed to move ahead with a more secure registry.