This worry exists for literally every 3rd party dependency, not just docker, and is addressed the same way - by running tests and vulnerability scans in a sandboxed test environment before shipping to prod

[–] roofuskit@lemmy.world 2 points 15 hours ago (1 children)

I was just answering a question. I had the same response above.

[–] zalgotext@sh.itjust.works 1 points 15 hours ago

And I was just adding extra details

[–] kitnaht@lemmy.world 2 points 19 hours ago (1 children)

Supply chain attack has a definition. And it has nothing to do with DDoS.

[–] GreenKnight23@lemmy.world 4 points 18 hours ago

ddos is vaguely related to a supply chain attack in the sense that it can be used as a distraction to implement said chain attack. it was pretty common tactic at one point.

disrupt services
implement bad library in backups as all focus turns to production
destroy production enough to require a restore

I think this is what they meant, but it's a stretch.