This is a lot of work to make available to the community and I’m sure I’m not the only one who appreciates that. There is just one statement in the documentation I believe should be amended:
It is likely a matter of time before someone exploits a stake pool by offering malicious images.
Given the high profile case here (which broke everyone’s hearts), already 3 weeks old, which was itself based on an already known means of injecting cryptocurrency harvesting malware into a docker image, maybe the threat could be characterised more broadly… as something that has happened before and will happen again unless people are willing to follow strict protocols about the sources of docker images & scripts?