Nix is also packaged in debian as nix-bin.

A common distribution method involves multi-party signing, that is, multiple developers use keys to sign off on reviewed changes.

Multiple developers review the changes, before signing the git commit after review. Then they build the package, either locally or on CI servers, but again, multiple parties/servers sign and review, doing a reproducible build to verify across machines.

In an ideal architecture, there is never a single point of failure. You would have to compromise the computers of multiple devs, or multiple build servers that are building signed reproducible builds, in order to do it.

Although in theory, you could compromise all of them. But it’s extremely difficult.

Anyway I was gonna write a rant about it but I’m too tired. But basically the docker ecosystem is kinda fucked in this regard, and trades security in many aspects for convenience of development and distribution. This is one of the most notable examples of this.

It’s popular because it’s convinient and easy to use in many ways. If these pitfalls are a dealbreaker for you, then there is no trivial way to add the security requirements you are asking for.

You can pay for signed images from someone else, which is a little better, but there are still disadvantages.

Also what are you building? You might be able to replace docker with nix for example.

I think the most popular solution is locally building and registry.

Is your comment supposed to say “native pf or nftables”?

Doesn’t it already do that?

When using the website it informs me if a link has already been losted, while also searching for similar posts via title.

The app I’m using (Eternity) doesn’t do that tho