Pin image to digest instead of :nightly (DB schema already ahead of stable 1.27, downgrading would break startup) and disable open self-registration/OpenID signup, which attackers used to plant xmrig via a git hook.
Pin image to digest instead of :nightly (DB schema already ahead of stable 1.27, downgrading would break startup) and disable open self-registration/OpenID signup, which attackers used to plant xmrig via a git hook.