Re:Docker Hub Hacked – 190k accounts, GitHub tokens revoked,...
by neovatar on Sunday April 28, 2019 @07:42AM
(#19770579)
Seems that dockerhub is using the github oauth permissions to do three things:
- retrieve a list of all repos to display in the autobuild setup page
- setup webhooks for the gh repo that should be built via dockerhub autobuild
- setup a deploy key for said repo, so that it can be cloned
I removed the dockerhub oauth on github side, after setting up autobuild. My builds on push to master and tag are still working. So it seems possible to remove dockerhubs write access to your github repos after the autobuild setup, which really seems to be a good idea.
- retrieve a list of all repos to display in the autobuild setup page
- setup webhooks for the gh repo that should be built via dockerhub autobuild
- setup a deploy key for said repo, so that it can be cloned
I removed the dockerhub oauth on github side, after setting up autobuild. My builds on push to master and tag are still working. So it seems possible to remove dockerhubs write access to your github repos after the autobuild setup, which really seems to be a good idea.