> "Secure by default" is a great philosophy to have. I hope Docker continues to push into this direction.
Thank you. We will absolutely keep pushing.
> However, where is image signing?
Docker supports image signing out-of-the-box. It's based on TUF which is the state if the art in secure content distribution. Along the way we open-sourced our underlying TUF implementation so thaf others can reuse it: https://github.com/docker/notary
> Where is pulling images by their hash instead of mutable tags?
That's also available out of the box: "docker pull NAME@DIGEST"
> Where is restricting what images run according to their hashes?
That's not available out of the box, but a popular way to implement it is to funnel images through a trusted private registry, only allow pulls from that registry, and then controlling what you push to it.
Another possibility is to use the new auth plugin system, although I haven't tried.
> Where is Docker not running a daemon as root?
Docker runs unprivileged by default, but only on relatively recent kernels with user namespace support (it drops itself to "fake root" so it can still create containers without actually having uid0).
On older systems (or if you don't trust user namespaces) I agree we could break up some parts of the daemon (for example push/pull) to drop privileges further. That requires serious refactoring which we have been working on gradually for some time.
> How about Docker doing more hardening releases and fewer feature releases?
We follow the linux methodology: every release includes many hardening improvements, as well as whatever features have been deemed stable enough to merge. We don't control what pull requests the community sends, but we work hard to maintain a high quality bar and encourage quality-oriented contributions. The Docker core engineering team invests more time on hardening than features.
> There's a lot of low hanging, security related fruit which haven't been picked. Why not?
I'm sure there are :) Security is a process, we will never be done. The important thing for us is to take it seriously, invest appropriately (Docker core team employs 6 full time security engineers and funds various third-party security efforts), and make sure we are perpetually improving.
On top of that, Docker is known for making powerful technology more accessible to more people. We want to use that "superpower" to make security more usable by non-experts. We think that contributes to making everyone more secure.
> Process isolation is a fantastic. There just really needs to be more, in my opinion.
Docker security is about much, much more than process isolation.
Thanks for the feedback. We hope to see you on the github repo, we value bug reports :)