Nix is also packaged in debian as nix-bin.

A common distribution method involves multi-party signing, that is, multiple developers use keys to sign off on reviewed changes.

Multiple developers review the changes, before signing the git commit after review. Then they build the package, either locally or on CI servers, but again, multiple parties/servers sign and review, doing a reproducible build to verify across machines.

In an ideal architecture, there is never a single point of failure. You would have to compromise the computers of multiple devs, or multiple build servers that are building signed reproducible builds, in order to do it.

Although in theory, you could compromise all of them. But it’s extremely difficult.

Anyway I was gonna write a rant about it but I’m too tired. But basically the docker ecosystem is kinda fucked in this regard, and trades security in many aspects for convenience of development and distribution. This is one of the most notable examples of this.

It’s popular because it’s convinient and easy to use in many ways. If these pitfalls are a dealbreaker for you, then there is no trivial way to add the security requirements you are asking for.

You can pay for signed images from someone else, which is a little better, but there are still disadvantages.

Also what are you building? You might be able to replace docker with nix for example.

I think the most popular solution is locally building and registry.

The version you get from Debian does respect all four freedoms.

The version that is installable from the repositories of Linux distros is all open source. Docker itself, the container engine and runtime are all open source. Nobody cares about stuff like docker desktop or docker sbx, not only are they not critical to the software itself, they aren’t that useful or valuable.

Docker is foss. Docker desktop and docker sbx are not.

Is your comment supposed to say “native pf or nftables”?

You can try to install the android version, using either

• Waydroid: https://wiki.archlinux.org/title/Waydroid
• Android translation layer: https://gitlab.com/android_translation_layer/android_translation_layer/