4 ms·
> No, they are not the same problem, and it has nothing to do with security. When you want to scale and spin up a new container... now you can't because your cr
by mateuszf 11y ago
> No, they are not the same problem, and it has nothing to do with security. When you want to scale and spin up a new container... now you can't because your credentials are baked into the image.
Another reason - once image is built - why rebuilding it? There is always a chance that you will end up with different versions of os or your packages. Immutable image which doesn't store credentials can be used on multiple environments with different credentials / configurations without changing / rebuilding the image.
- lisivka 11y agoYou can always add layer with new credentials. E.g. FROM image:staging COPY ./production-credentials/ / When implemented in this way, staging image won't be able to run in production code until it will be tested and accepted (sealed) using formal process. If you will use environment variables, you (or your deployment team) will be able to run staging images in production at any moment.
- mateuszf 11y agoHaven't thought about it - that's a nice solution, thanks.