BAbased2·Feb 3, 2021Submission
Cloud Native Application Bundles Security (CNAB-SEC) 1.0.0 GA 2020
1 points · Open discussioncnabio
cnab-spec
Shell2018–2021
cnabio / cnab-spec
cnab-spec
Cloud Native Application Bundle Specification
4Distinct people
4Mentions
0Explicit recommenders
972GitHub stars
What to know before exploring
What it is
Cloud Native Application Bundle Specification
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by month4 dated mentions
Observed mentions: 2018-12-04 18:09:17 UTC to 2021-02-03 20:53:51 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| Dec 2018 | 2018-12-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 2 | 0 | 2 |
| Jan 2019 | 2019-01-01 00:00:00 UTC | 2019-02-01 00:00:00 UTC | 0 | 0 | 0 |
| Feb 2019 | 2019-02-01 00:00:00 UTC | 2019-03-01 00:00:00 UTC | 0 | 0 | 0 |
| Mar 2019 | 2019-03-01 00:00:00 UTC | 2019-04-01 00:00:00 UTC | 0 | 0 | 0 |
| Apr 2019 | 2019-04-01 00:00:00 UTC | 2019-05-01 00:00:00 UTC | 0 | 0 | 0 |
| May 2019 | 2019-05-01 00:00:00 UTC | 2019-06-01 00:00:00 UTC | 0 | 0 | 0 |
| Jun 2019 | 2019-06-01 00:00:00 UTC | 2019-07-01 00:00:00 UTC | 0 | 0 | 0 |
| Jul 2019 | 2019-07-01 00:00:00 UTC | 2019-08-01 00:00:00 UTC | 0 | 0 | 0 |
| Aug 2019 | 2019-08-01 00:00:00 UTC | 2019-09-01 00:00:00 UTC | 0 | 0 | 0 |
| Sep 2019 | 2019-09-01 00:00:00 UTC | 2019-10-01 00:00:00 UTC | 1 | 0 | 1 |
| Oct 2019 | 2019-10-01 00:00:00 UTC | 2019-11-01 00:00:00 UTC | 0 | 0 | 0 |
| Nov 2019 | 2019-11-01 00:00:00 UTC | 2019-12-01 00:00:00 UTC | 0 | 0 | 0 |
| Dec 2019 | 2019-12-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 0 | 0 | 0 |
| Jan 2020 | 2020-01-01 00:00:00 UTC | 2020-02-01 00:00:00 UTC | 0 | 0 | 0 |
| Feb 2020 | 2020-02-01 00:00:00 UTC | 2020-03-01 00:00:00 UTC | 0 | 0 | 0 |
| Mar 2020 | 2020-03-01 00:00:00 UTC | 2020-04-01 00:00:00 UTC | 0 | 0 | 0 |
| Apr 2020 | 2020-04-01 00:00:00 UTC | 2020-05-01 00:00:00 UTC | 0 | 0 | 0 |
| May 2020 | 2020-05-01 00:00:00 UTC | 2020-06-01 00:00:00 UTC | 0 | 0 | 0 |
| Jun 2020 | 2020-06-01 00:00:00 UTC | 2020-07-01 00:00:00 UTC | 0 | 0 | 0 |
| Jul 2020 | 2020-07-01 00:00:00 UTC | 2020-08-01 00:00:00 UTC | 0 | 0 | 0 |
| Aug 2020 | 2020-08-01 00:00:00 UTC | 2020-09-01 00:00:00 UTC | 0 | 0 | 0 |
| Sep 2020 | 2020-09-01 00:00:00 UTC | 2020-10-01 00:00:00 UTC | 0 | 0 | 0 |
| Oct 2020 | 2020-10-01 00:00:00 UTC | 2020-11-01 00:00:00 UTC | 0 | 0 | 0 |
| Nov 2020 | 2020-11-01 00:00:00 UTC | 2020-12-01 00:00:00 UTC | 0 | 0 | 0 |
| Dec 2020 | 2020-12-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 0 | 0 | 0 |
| Jan 2021 | 2021-01-01 00:00:00 UTC | 2021-02-01 00:00:00 UTC | 0 | 0 | 0 |
| Feb 2021 | 2021-02-01 00:00:00 UTC | 2021-03-01 00:00:00 UTC | 1 | 1 | 0 |
What Hacker News says
4 sourcesNPM should use The Update Framework (TUF) [1] and in-toto [2] in order to protect its users from attacks against the registry itself. A notable list of adoptions include:
* Datadog is using both TUF and in-toto to defend against attacks between developers and end-users of its Agent integrations [3].
* Docker Content Trust is protecting users from a compromise of Docker Hub itself [4] using a version of TUF [5].
* Uptane is a version of TUF that is being standardized to protect software updates for automobiles [6].
* PyPI is considering adopting TUF to protect users of Python packages [7].
* Cloud Native Application Bundles is standardizing the use of TUF and in-toto to protect users of cloud-native applications [8].
Disclosure: I am a security engineer at Datadog, and am involved with both TUF and in-toto.
[1] https://theupdateframework.c
Read the rest
om
[2] https://in-toto.io
[3] https://www.datadoghq.com/blog/engineering/secure-publicatio...
[4] https://success.docker.com/article/docker-hub-user-notificat...
[5] https://blog.docker.com/2015/08/content-trust-docker-1-8/
[6] https://uptane.github.io/
[7] https://github.com/pypa/warehouse/issues/5247
[8] https://github.com/deislabs/cnab-spec/blob/master/300-CNAB-s...
From reading the spec though it looks like everything uses containers built from a Dockerfile:
"A bundle is comprised of a bundle definition and at least one invocation image. The invocation image's job is to install zero or more components into the host environment. Such components MAY include (but are not limited to) containers, functions, VMs, IaaS and PaaS layers, and service frameworks."
So, the very first step of CNAB is to run a container. And CNAB invents a new way of configuring, lifecycling, etc, this container image.
[1] https://github.com/deislabs/cnab-spec/blob/master/100-CNAB.m...
In Microsoft and Docker team up to make packaging cloud-native applications easierYes. See credential sets in the specification.
https://github.com/deislabs/cnab-spec/blob/master/802-creden...
In Microsoft and Docker team up to make packaging cloud-native applications easier