The new box ubuntu/trusty64 and the security issues

[DevelopDaily]

Since I am a new fan of the Vagrant, please educate me a little bit about the security issues of using Vagrant.

I "up" the new box ubuntu/trusty64 released two days ago. How do I know if that box comes from a reputable provider like ubuntu or HashiCorp? Does HashiCorp do the security checks on the published boxes?

I am running the ubuntu/trusty64 now. For the sake of argument, if the ubuntu/trusty64 comes from a malicious provider, is it the user's responsibility to scan it for viruses, spyware, etc. after the "up"?

Thanks.

[Alvaro Miranda Aguilera]

Hello.

Since Vagrant 1.5+ vagrant can download boxes from atlas in the format from user/box, so think in the vagrant boxes hosted at atlas as an index or repository.

From there, for development work, you can say the boxes over there give you flexibility, agility, convenience, however you have the option to use them or not.

If you require boxes that are fully patched, and you require a more controlled release cycle then you can build your own boxes.

If you go to this url:

https://atlas.hashicorp.com/tutorial/packer-vagrant/0

Thats a tutorial to use packer + atlas builder to build boxes.

The tutorial will be on ubuntu 12.04, however is an example, once you are happy with the results (your own box), you can move to different OS and have the combination you are after, and level of confidence you require.

There are lots of packer templates in the internet, and chef have a project called bento with lots of OS combinations to get you started:

https://github.com/chef/bento

Thanks

Alvaro.

--
This mailing list is governed under the HashiCorp Community Guidelines - https://www.hashicorp.com/community-guidelines.html. Behavior in violation of those guidelines may result in your removal from this mailing list.
 
GitHub Issues: https://github.com/mitchellh/vagrant/issues
IRC: #vagrant on Freenode
---
You received this message because you are subscribed to the Google Groups "Vagrant" group.
To unsubscribe from this group and stop receiving emails from it, send an email to vagrant-up+...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/vagrant-up/2e847687-da74-46b3-8bc1-ed2e52aadfc8%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[DevelopDaily]

Thanks for the useful info.

I am wondering why the publicly distributed boxes are not digitally signed.

I mean, nowadays, if you download a piece of software from a reputable source, the software is usually signed. Here we are talking about a full-blown virtual machine, yet it is not signed! What is the rationale behind it, considering this Vagrant thing is going to be used by more and more corporate users, perhaps even by banks and the Pentagon.

[Alvaro Miranda Aguilera]

Hello,

I can understand your concern, but trust me that corporate, banks, etc, they build their own boxes in house, in private and controlled environment.

The Vagrant boxes are to be used on dev cycles, not mean to be run in production. What you move into production is the app code, etc not the Virtualbox OS.

Hope this helps to clarify.

If you need assistance or guidelines to build your own secure safe signed boxes, feel free to replay and we can take it from there.

Alvaro.

--

This mailing list is governed under the HashiCorp Community Guidelines - https://www.hashicorp.com/community-guidelines.html. Behavior in violation of those guidelines may result in your removal from this mailing list.
 
GitHub Issues: https://github.com/mitchellh/vagrant/issues
IRC: #vagrant on Freenode
---
You received this message because you are subscribed to the Google Groups "Vagrant" group.
To unsubscribe from this group and stop receiving emails from it, send an email to vagrant-up+...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/vagrant-up/e4958398-dc46-4806-a44a-ca0c3a543896%40googlegroups.com.

[pixel fairy]

https://github.com/boxcutter

they cover most OSes and you can easily how its done. there are people who push vagrant into production.

https://www.vagrantup.com/docs/push/

[Alvaro Miranda Aguilera]

hello,

minor clarification please.

Vagrant push will move code, not boxes.

Alvaro.

--

This mailing list is governed under the HashiCorp Community Guidelines - https://www.hashicorp.com/community-guidelines.html. Behavior in violation of those guidelines may result in your removal from this mailing list.
 
GitHub Issues: https://github.com/mitchellh/vagrant/issues
IRC: #vagrant on Freenode
---
You received this message because you are subscribed to the Google Groups "Vagrant" group.
To unsubscribe from this group and stop receiving emails from it, send an email to vagrant-up+...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/vagrant-up/8118be1d-8296-497d-92ec-8b5115f0d879%40googlegroups.com.