Security review: warn if NOT --pull-policy=always in container

[natalieparellano]

Description

In the security review, this is HIGH-1: Host compromise by overwriting trusted container images. The action plan asks us to ensure that

The CNB platform should prevent users from creating final application images having the same tags as trusted builders or as the trusted lifecycle image used when building applications

The underlying root cause of the vulnerability is using a shared docker daemon as a source and sink for builds (vs the registry, where namespace permissions prevent unauthorized writes).

Proposed solution

If we detect that pack is running in a container, we should warn if NOT --pull-policy=always. The warning message should mention that this configuration is insecure and that support may be removed in the future.

Describe alternatives you've considered

Related issue:#2223.

Additional context

• This feature should be documented somewhere

[natalieparellano]

Note: previous versions of this issue mentioned checking that --publish=true. But that only prevents the current invocation from polluting the daemon for future invocations. To ensure the current invocation is safe, we only need to care about the pull policy.