Insecure Container Registry Configuration

Detects Docker/container registry configurations using unauthenticated or HTTP (non-HTTPS) registries.

zakirkun Updated

File contents

Insecure Container Registry Configuration

Overview

Using insecure Docker registries (HTTP rather than HTTPS, or self-signed certificates without verification) exposes:

  • Image pull/push credentials to network interception
  • Registry poisoning through MITM — serving malicious images

Remediation

  • Use HTTPS for all container registries
  • Configure proper TLS certificates
  • Use --insecure-registry only in development, never in production

zakirkun/ice-tea/tree/main/skills/devops/insecure-registry commit 471ce0a5c2

Frequently asked questions

npx skillmds@latest add zakirkun/insecure-container-registry-configuration