3 ms·

If I run dozens of containers based on the same Debian image, would Minideb or even Alpine bring a big change, considering that Docker caches the layers?

• devonkim 9y ago
  The point of smaller images to me isn't about disk savings as much as minimizing dependencies and surface area of attacks such as for glibc, bash, and OpenSSL in the past several years. Updating container images quickly is absolutely essential given the myriad of possible problems if they were to become stale. I suppose it wouldn't hurt to have smaller image layers when updating these containers more frequently to save on bandwidth at least.
  • peterwwillis 9y ago
    Reducing attack surface by only minimizing dependencies is a bit like putting your house on stilts.
    • ridruejo 9y ago
      Can you elaborate why you think that is the case? This is a well-established security practice. I don't see much upside to having code or binaries around that are not needed but can be potentially exploited. One of the first things I did when I used to manage servers was shutdown and remove any services not needed, disable all Apache modules not in use, etc.
      • peterwwillis 9y ago
        A house on stilts makes it difficult to rob, but not for the man who walks on stilts. Security practices need to be implemented holistically or they are easily defeated. By themselves they aren't worth much and end up being unnecessarily cumbersome. Removing outlying code that could be used as part of an attack can be useful for complex attacks. But they are essentially outliers - the actual code that you are actually running and is the actual target is still there, waiting to be pwnd. The time you spend trimming fat can often be better used to actually harden a system's access control or policies/procedures, perform auditing, etc.
    • wvenable 9y ago
      You're arguing a straw man by putting the word only in there.
      • peterwwillis 9y ago
        The author said 3 different things in their comment. I was answering this: "The point [..] isn't about disk savings as much as minimizing dependencies and surface area of attacks such as for glibc, bash, and OpenSSL in the past several years." Technically they didn't say specifically how they would minimize surface area of attacks, so my assumption that they meant only by minimizing dependencies (seeing as their comment was followed by a list of dependencies) may have been faulty. Thanks for letting me know that in such a kind way.
• CoreXtreme 9y ago
  Yes, they can certainly help in cases where you are offering your images to others. Assuming, initial size is zero. If you install 100MB of packages in layer 1. Then in second layer, you uninstall of those packages. Your image size will still be 100MB. If you are optimizing for high density, a smaller size certainly helps.
  • amq 9y ago
    Others are very likely to already have the Debian base image cached - by using pretty much any official library image.