⬇ Download holy card: ·
Blessed ImageRunner, Courier of Other People's Images
Patron of private containers, overly helpful service agents, and people allowed to update but not to read.
Life
On 1 April 2025, and it was no joke, Liv Matan of Tenable described ImageRunner, a flaw in Google Cloud Run. Someone who could edit a revision, but not read the image registry, could still get a private image from the same project deployed: Cloud Run's service agent fetched it with its own permissions. A delivery driver who hands the parcel to whoever signs the slip.
Prayer
O Blessed ImageRunner, who brings people what they were not allowed to see, let every delivery check the recipient first. Amen.
How to celebrate
Celebrated by recalling that since 28 January 2025 Cloud Run requires whoever creates a revision to have read access to the image, and by reviewing IAM roles at leisure.
Eager courier, empty warehouse.