Rory McCune, a security specialist, writes about container and Kubernetes security, Docker risks and scanner bypasses.
HN commenters cite him on how vulnerability scanners can be bypassed, why mounting docker.sock read-only doesn't help, and Kubernetes etcd security.
so with two patreon style sites both of which say "we take security seriously" , until they have a breach, how would you judge which one would take better care of your data?
The information (AFAIK) about their security mechanisms only got released as a result of the breach, so even assuming you knew what the terms were and how to judge good security from bad, you wouldn't have the information until the site got compromised.
This is a very common problem, some more examples here http://raesene.github.io/blog/2014/06/08/finding-security/
It's worth noting that whilst vulnerability scanners are very useful, they pretty easy to bypass, if someone creates an image and doesn't want them to flag things up.
One very basic example is https://raesene.github.io/blog/2023/04/22/Fun-with-container-images-Bypassing-vulnerability-scanners/
no worries, I've got some more info. on that on my blog https://raesene.github.io/blog/2017/05/01/Kubernetes-Security-etcd/ which may be of use.
According to this: https://raesene.github.io/blog/2016/03/06/The-Dangers-Of-Docker.sock/
mounting the socket readonly doesn't help.
Link in parenthesis got broken: https://raesene.github.io/blog/2016/10/08/Kubernetes-From-Container-To-Cluster/