Container images security

[ntropia2]

I have some experience with the qemu/KVM installation but today I tried the docker route for the first time.
I was taken aback when during the installation process it showed that it was downloading the Windows image from a website I'm not familiar with:

[+] Running 1/1
 ✔ Container WinApps  Recreated                                                                                                                                    0.8s 
Attaching to WinApps
WinApps  | ❯ Starting Windows for Docker v3.12...
WinApps  | ❯ For support visit https://github.com/dockur/windows
WinApps  | ❯ CPU: Intel Xeon CPU E5 1620 0 | RAM: 21/32 GB | DISK: 750 GB (ext4) | HOST: 6.1.0-23-amd64...
WinApps  | 
WinApps  | ❯ Downloading Tiny 11 from cnxiaobai.com...
WinApps  | 

The site (cnxiaobai.com) is part of the Alibaba domains in China, as far as I can tell. I don't feel comfortable downloading the whole OS from an unofficial source for obvious security concerns.

Could anyone help clarifying this?

[oskardotglobal]

The image is sourced by the folks over at https://github.com/dockur/windows.
However, since Microsoft doesn't particularly like people making their OS lighter and better, they take down most of the Tiny11 images, leading to "sketchy" hosts. If you're concerned about the safety of this image, open an issue on the dockur/windows repo and use microsoft-provided windows by setting the version to win11 in your compose file.

[ntropia2]

Thanks for the quick reply.
I think this is an important bit of information that should be made available to the users.

Ultimately, this means that the default installation of WinApps should not be trusted, and that's a major showstopper for its broad application.

I would argue that using the official Microsoft source should be the default choice, but I would be happy even if the documentation in the installation instructions would be updated to mention where the OS image is pulled from and what the implications are.

[LDprg]

@ntropia2 If trustability is your issue you shouldn't use tiny11 at all and use the win11 image instead. Tiny11 is modified version of win11 by a single programmer, the official download site is archive.org which isn't a casual distribution platform.