3 ms·
One thing that does get a mention but only right at the bottom of the post is using smaller base images (e.g. Alpine). If you can I'd recommend this as a good
by raesene9 10y ago
One thing that does get a mention but only right at the bottom of the post is using smaller base images (e.g. Alpine).
If you can I'd recommend this as a good practice to reduce these kinds of problems. The fundamental fact is that if you don't have a library installed, you can't be affected by a vulnerability in it. So the smaller your image, the fewer possible avenues for shipping vulnerable libs you'll have and you'll have to spend less time re-building images with updated packages.
- jsulinski 10y agoAbsolutely. I intended this post to identify (some of) the problems/challenges. My next post will focus on how to address them. Alpine is definitely one of the major points, as well as static binary images and some advice on Dockerfile configuration.
- Diederich 10y agoHonest question: Do you know if Alpine ships patches to substantial vulnerabilities more quickly than Debian and/or Ubuntu? Thanks!
- jsulinski 10y agoI don't know the answer to this, but I do know that Alpine has some really awesome stuff around vulnerabilities, and I would presume that they react to vulnerabilities more quickly. However, I intend to validate this presumption in a future project.
- Diederich 10y agoThank you! I'd love to hear your findings.