3 ms·
I don't understand your conclusion. The exploit in the article was reported to the Alpine Linux maintainers and the fix was promptly made to apk-tools (https://
by Gigablah 9y ago
I don't understand your conclusion. The exploit in the article was reported to the Alpine Linux maintainers and the fix was promptly made to apk-tools (https://git.alpinelinux.org/cgit/aports/commit/?id=b849b481a0446d7ef2458232a8819ce0b301e629 https://git.alpinelinux.org/cgit/aports/commit/?id=b849b481a...), so if you rebuilt a docker image based off Alpine you'd have gotten the security update like you described.
- mschuster91 9y ago> so if you rebuilt a docker image based off Alpine you'd have gotten the security update like you described. Only if I directly base off my image from Alpine. All images that base off something that either directly bases off Alpine (or worse, with more intermediaries) have a problem as ALL images in the chain must be rebuilt. That is the core problem.
- Gigablah 9y agoTBH you'd have the same problem if you based your image off an intermediate Debian/Ubuntu-based image. I always build my images directly off Alpine anyway, or a base image that I control. (In this case though, the security fix is for the apk-tools package and not the distro itself, so as long as you have apk update+upgrade in your final build, whether the intermediate images are rebuilt doesn't matter.)