creates ssh host key on build

[kiney]

The ssh host key is created generated in the apt/deb script. So in case of this image at build time.
Using prebuilt images (from dockerhub) therefore is a security risk.

[rastasheep]

Hi @kiney thanks for note!

Do you think if generating key in runtime will make difference since root login is enabled and dummy password is used?

[rastasheep]

We've added security notice to the readme (#20), also there are now commands for how to improve it. Do you suggest anything else to add?

[kiney]

Hi, thanks for the answer.
Problem with re-using host keys that are present in public builds is that there's no way to protect against MITM attacks. For some use cases this is no problem, for others it is.
It should just be clear from documentation. I personally just run my own builds to have my own host keys.