Fortify finding : Insecure Transport in run_packet.go about linuxkit

[deitch]

Can you link to the actual file and lines?

[neelpandya]

Sure, here is link from the current master -

https://github.com/linuxkit/linuxkit/blob/master/src/cmd/linuxkit/run_packet.go#L128

[deitch]

The commit that added it is here, with the comment:

The -serve command starts a local HTTP server which serves
the kernel and initrd files. The server can then easily be
made available via ngrok or other means.

The reason for it is that Packet (now Equinix Metal) does custom operating systems via iPXE, so you need something to act as the iPXE server. You can use something hosted, or, for testing, you can use this, run a local http server that is listening on localhost, and then use some remote-to-Internet service, like ngrok or inlets, to expose it to the Internet.

Either way, it is intended for testing, e.g. linuxkit run packet someos, which is not part of building an OS or the built OS itself, only part of "here is how I can run it easily via command-line for testing purposes".

[neelpandya]

Thanks a lot for clarifying .