6 ms·

Alpine Linux 3.4.0 Released

137 points by xfiler 10y ago

rdsubhas 10y ago
> support for DNS search in /etc/resolv.conf Big news. This was a huge blocker in containerized environments, now can't wait to try this out. Great work!
- eknkc 10y ago
  Yeah we could not use alpine based images on kubernetes all this time, should work just fine now.
trevorhartman 10y ago
Awesome. I've been waiting for the DNS fix (along with everyone else) so I can run it on Kubernetes. I don't see a new Docker tag yet: https://hub.docker.com/r/library/alpine/tags/ https://hub.docker.com/r/library/alpine/tags/ Anyone know when it's expected to hit? Edit: here's the issue tracking it https://github.com/gliderlabs/docker-alpine/issues/178 https://github.com/gliderlabs/docker-alpine/issues/178
- trevorhartman 10y ago
  Docker image is up! https://hub.docker.com/r/library/alpine/tags/ https://hub.docker.com/r/library/alpine/tags/
gbrown_ 10y ago
Anyone know how things are panning out after the grsecurity stopped making their stable patch series freely available? There was a fourm post and message on the mailing list a while but I've not been able to find anything more recent.
- neoCrimeLabs 10y ago
  IIRC, established linux distributions that were using the stable patch set before could still have access to the stable patch after it closed. Did that change?
  - lolidaisuki 10y ago
    At least Alpine and Arch use the demo (testing) version. IIRC their initial announcement said that the distros can continue using the demo version and not the stable version unless they pay. And no distro can get the stable version even by paying because Brad knows that the distro would have to redistribute the sources as per GPLv2 and thus he will only make ridiculously high offers. There is no distro or any other consumer product that does or ever will have the stable patches. Brad is a greedy asshole and all around a bad person.
- geofft 10y ago
  How exactly are they doing this without either violating the GPL or failing to keep their patches secret?
  - striking 10y ago
    If you release the content to people who shouldn't have it, the next set will not be distributed to you. Your contract will not be renewed. https://archive.is/qt0n2 https://archive.is/qt0n2
    - techdragon 10y ago
      Wait ... That's actually working? I had heaps of things I shitcanned as not even remotely profitable to do because all common sense told me that this exact tactic would not work.
      - striking 10y ago
        You can. It seems legal (tho IANAL) and it seems to be working in practice. Thing is, your distribution chain needs to be extremely tight (watermarked data or careful chain of trust) or else content will just get leaked every patch.
      - cyphar 10y ago
        I'm fairly sure it's not legal, because you're acting in bad faith (while you haven't changed the License terms, you are effectively coercing people into not being able to take advantage of the license). I'd also consider the tactic immoral because you're adding restrictions to free (and copylefted) software.
    - geofft 10y ago
      How do they reconcile this with the statement on https://grsecurity.net/download.php https://grsecurity.net/download.php that the patches are under GPLv2 and distributors must ship the complete corresponding source? What happens if I redistribute grsecurity binary kernels with no other patches, and offer source as I am obligated to do?
wonks 10y ago
I see it uses busybox. Does this mean it's for low-spec instances and embedded devices, or did they base it on busybox because shellshock only affected GNU Bash and they felt the GNU tools couldn't be trusted anymore?
- thawkins 10y ago
  It's used a lot as a guest os useland and init inside docker deployments, becuase it's very small. This means you can run a lot of docker images in one machine if you use alpine inside them, fully loaded alpine docker base is about 8mb.
  - moreentropy 10y ago
    The thing about docker is that the containers are thin provisioned, you can run as many containers based on 8GB images if you have the spare 8GB for the base image. Still, bloat is to be avoided so Alpine as a base image is a great idea.
    - justincormack 10y ago
      And the 8GB for the next version of the base system and so on, base system updates are fairly frequent.
  - agumonkey 10y ago
    Wanted to do network lab using VirtualBox VMS. Used archlinux iso images at first but they require 256MB of ram to boot IIRC. I stumbled upon alpine linux. I think I booted some with 64MB only. Enough for DNS and DHCP tutorials.
  - technion 10y ago
    The thing I've liked about this is that bloat isn't just about size. If you have no reason to interact with the userland tools inside a Docker container, you similarly have no reason to introduce their complexity and attack surface in a container designed to run one service. My current "minimal" installation shows 25 SUID binaries (a large amount of them being systemd related...) and my server services need very few of these.
nivertech 10y ago
Is there Alpine Linux AMIs for AWS and/or images for GCE?
- justincormack 10y ago
  Not yet unfortunately that I know of. There are some oldish instructions for AWS here https://wiki.alpinelinux.org/wiki/Install_Alpine_on_Amazon_EC2 https://wiki.alpinelinux.org/wiki/Install_Alpine_on_Amazon_E... and it was suggested that a community project might help build official cloud images.
omginternets 10y ago
I've dabbled with Alpine and been very impressed, but ultimately my team is using a debian base image because we ran into occasional difficulties linking against musl. We still haven't hit any apparent bottlenecks using debian:jessie. Where are said bottlenecks? Where should I be paying attention?
deleted 10y ago
[deleted]

137 points by xfiler 10y ago

> support for DNS search in /etc/resolv.conf Big news. This was a huge blocker in containerized environments, now can't wait to try this out. Great work!

eknkc 10y ago
Yeah we could not use alpine based images on kubernetes all this time, should work just fine now.

trevorhartman 10y ago

Awesome. I've been waiting for the DNS fix (along with everyone else) so I can run it on Kubernetes. I don't see a new Docker tag yet: https://hub.docker.com/r/library/alpine/tags/ https://hub.docker.com/r/library/alpine/tags/ Anyone know when it's expected to hit? Edit: here's the issue tracking it https://github.com/gliderlabs/docker-alpine/issues/178 https://github.com/gliderlabs/docker-alpine/issues/178

trevorhartman 10y ago
Docker image is up! https://hub.docker.com/r/library/alpine/tags/ https://hub.docker.com/r/library/alpine/tags/

gbrown_ 10y ago

Anyone know how things are panning out after the grsecurity stopped making their stable patch series freely available? There was a fourm post and message on the mailing list a while but I've not been able to find anything more recent.

neoCrimeLabs 10y ago
IIRC, established linux distributions that were using the stable patch set before could still have access to the stable patch after it closed. Did that change?
- lolidaisuki 10y ago
  At least Alpine and Arch use the demo (testing) version. IIRC their initial announcement said that the distros can continue using the demo version and not the stable version unless they pay. And no distro can get the stable version even by paying because Brad knows that the distro would have to redistribute the sources as per GPLv2 and thus he will only make ridiculously high offers. There is no distro or any other consumer product that does or ever will have the stable patches. Brad is a greedy asshole and all around a bad person.
geofft 10y ago
How exactly are they doing this without either violating the GPL or failing to keep their patches secret?
- striking 10y ago
  If you release the content to people who shouldn't have it, the next set will not be distributed to you. Your contract will not be renewed. https://archive.is/qt0n2 https://archive.is/qt0n2
  - techdragon 10y ago
    Wait ... That's actually working? I had heaps of things I shitcanned as not even remotely profitable to do because all common sense told me that this exact tactic would not work.
    - striking 10y ago
      You can. It seems legal (tho IANAL) and it seems to be working in practice. Thing is, your distribution chain needs to be extremely tight (watermarked data or careful chain of trust) or else content will just get leaked every patch.
    - cyphar 10y ago
      I'm fairly sure it's not legal, because you're acting in bad faith (while you haven't changed the License terms, you are effectively coercing people into not being able to take advantage of the license). I'd also consider the tactic immoral because you're adding restrictions to free (and copylefted) software.
  - geofft 10y ago
    How do they reconcile this with the statement on https://grsecurity.net/download.php https://grsecurity.net/download.php that the patches are under GPLv2 and distributors must ship the complete corresponding source? What happens if I redistribute grsecurity binary kernels with no other patches, and offer source as I am obligated to do?

wonks 10y ago

I see it uses busybox. Does this mean it's for low-spec instances and embedded devices, or did they base it on busybox because shellshock only affected GNU Bash and they felt the GNU tools couldn't be trusted anymore?

thawkins 10y ago
It's used a lot as a guest os useland and init inside docker deployments, becuase it's very small. This means you can run a lot of docker images in one machine if you use alpine inside them, fully loaded alpine docker base is about 8mb.
- moreentropy 10y ago
  The thing about docker is that the containers are thin provisioned, you can run as many containers based on 8GB images if you have the spare 8GB for the base image. Still, bloat is to be avoided so Alpine as a base image is a great idea.
  - justincormack 10y ago
    And the 8GB for the next version of the base system and so on, base system updates are fairly frequent.
- agumonkey 10y ago
  Wanted to do network lab using VirtualBox VMS. Used archlinux iso images at first but they require 256MB of ram to boot IIRC. I stumbled upon alpine linux. I think I booted some with 64MB only. Enough for DNS and DHCP tutorials.
- technion 10y ago
  The thing I've liked about this is that bloat isn't just about size. If you have no reason to interact with the userland tools inside a Docker container, you similarly have no reason to introduce their complexity and attack surface in a container designed to run one service. My current "minimal" installation shows 25 SUID binaries (a large amount of them being systemd related...) and my server services need very few of these.

nivertech 10y ago

Is there Alpine Linux AMIs for AWS and/or images for GCE?

justincormack 10y ago
Not yet unfortunately that I know of. There are some oldish instructions for AWS here https://wiki.alpinelinux.org/wiki/Install_Alpine_on_Amazon_EC2 https://wiki.alpinelinux.org/wiki/Install_Alpine_on_Amazon_E... and it was suggested that a community project might help build official cloud images.

omginternets 10y ago

I've dabbled with Alpine and been very impressed, but ultimately my team is using a debian base image because we ran into occasional difficulties linking against musl. We still haven't hit any apparent bottlenecks using debian:jessie. Where are said bottlenecks? Where should I be paying attention?

deleted 10y ago

[deleted]