4 ms·

In addition to the "minimalist" aspect, this image seems to offer better practices on a security level than official Debian images. From their README: "The imag

In addition to the "minimalist" aspect, this image seems to offer better practices on a security level than official Debian images. From their README: "The images are built daily and have the security release enabled, so will contain any security updates released more than 24 hours ago." A recent analysis showed that the debian:latest image is "updated roughly every month" https://anchore.com/blog/look-often-docker-images-updated/ https://anchore.com/blog/look-often-docker-images-updated/

viraptor 9y ago
I couldn't find anything in the post that correlates the Debian updates with security notices (which is your main point). If a security advisory comes out every 2-5 weeks and Debian updates on the same schedule, then I don't see a problem. But the data is just not there. (These have to be advisories actually affecting the image, not all of them)
zenlikethat 9y ago
> In addition to the "minimalist" aspect, this image seems to offer better practices on a security level than official Debian images I'm skeptical about this claim. Almost every image built from the Debian official image begins with `apt-get update` before you can actually install anything, which means you will almost always have the latest packages at the time of building.
- gramakri 9y ago
  apt update only updates the package list and not the packages themselves. So unless the docker file contains apt upgrade it still uses old packages.
  - zenlikethat 9y ago
    There's nothing to upgrade. Pretty much nothing is installed already in most base images. Even `ca-certificates` etc. have to be installed.
    - yebyen 9y ago
      are you saying that most base images don't have ssl? because i'm a baseimage maintainer (http://github.com/phusion/baseimage http://github.com/phusion/baseimage) and I don't think that's true... https://github.com/phusion/baseimage-docker/blob/master/image/prepare.sh#L34 https://github.com/phusion/baseimage-docker/blob/master/imag...
      - nyrikki 9y ago
        No offence intended and these terms are not tightly defined but I would call your imaged a 'baked' image. My feeling is that I don't know how long a base-image will stick around. If ca-certificates is installed in my base image it may end up trusting revoked certificates. IMHO it is better to know you need to install/bake in ca-certs from a trusted source than to having a built in, potentially compromised CA cert installed. Baked images, which I use to reduce instantiation time, or 'golden' images that are immutable infrastructure tend to have shorter lifespans and the CA package is carried in the application dependencies and more likely to be up to date.
        yebyen 9y ago
        No offense inferred! It is not intended that users will download this baseimage (although it is a supported configuration, you can use FROM phusion/baseimage) but, that this will be an image definition that users can easily rebuild and build off of it. Step one in Docker competency is "do you know exactly where your image comes from, and can you rebuild it from scratch without trusting that some rando on the internet didn't put bad stuff in there?" Step two is "ok, do you really actually build them, though" This image has traditionally been based on LTS ubuntu, and if you look at the CentOS derived version that hasn't been updated since 2014 (pokle/centos-baseimage), they chose not to include ca-certificates or hardly anything else. (I'm assuming that tianon/centos:6.5 does not install ca-certificates by default...) I'm sure many people use FROM phusion/baseimage but personally, even as a maintainer, I don't. I'd change the image source to whatever upstream of Ubuntu I'm preferring today, and probably build that from scratch too. The value in this image is not that it comes pre-built, it's that the build is tested and supported. /side tangent
- nyrikki 9y ago
  While not as small it is trivial to make an up-to-date debian base image (or Fedora/Arch) any time you want. If you care about security you probably don't want to use random unverified images anyway. $ sudo debootstrap stretch mydebian http://mirrors.kernel.org/debian/ $ cd mydebian $ sudo tar -c . | docker import - mydebian Plus you can add files to the system before taring etc... If you have significant work to do on an image a Dockerfile can often be far more complex than this method.

viraptor 9y ago

I couldn't find anything in the post that correlates the Debian updates with security notices (which is your main point). If a security advisory comes out every 2-5 weeks and Debian updates on the same schedule, then I don't see a problem. But the data is just not there. (These have to be advisories actually affecting the image, not all of them)

zenlikethat 9y ago

> In addition to the "minimalist" aspect, this image seems to offer better practices on a security level than official Debian images I'm skeptical about this claim. Almost every image built from the Debian official image begins with `apt-get update` before you can actually install anything, which means you will almost always have the latest packages at the time of building.

gramakri 9y ago
apt update only updates the package list and not the packages themselves. So unless the docker file contains apt upgrade it still uses old packages.
- zenlikethat 9y ago
  There's nothing to upgrade. Pretty much nothing is installed already in most base images. Even `ca-certificates` etc. have to be installed.
  - yebyen 9y ago
    are you saying that most base images don't have ssl? because i'm a baseimage maintainer (http://github.com/phusion/baseimage http://github.com/phusion/baseimage) and I don't think that's true... https://github.com/phusion/baseimage-docker/blob/master/image/prepare.sh#L34 https://github.com/phusion/baseimage-docker/blob/master/imag...
    - nyrikki 9y ago
      No offence intended and these terms are not tightly defined but I would call your imaged a 'baked' image. My feeling is that I don't know how long a base-image will stick around. If ca-certificates is installed in my base image it may end up trusting revoked certificates. IMHO it is better to know you need to install/bake in ca-certs from a trusted source than to having a built in, potentially compromised CA cert installed. Baked images, which I use to reduce instantiation time, or 'golden' images that are immutable infrastructure tend to have shorter lifespans and the CA package is carried in the application dependencies and more likely to be up to date.
      - yebyen 9y ago
        No offense inferred! It is not intended that users will download this baseimage (although it is a supported configuration, you can use FROM phusion/baseimage) but, that this will be an image definition that users can easily rebuild and build off of it. Step one in Docker competency is "do you know exactly where your image comes from, and can you rebuild it from scratch without trusting that some rando on the internet didn't put bad stuff in there?" Step two is "ok, do you really actually build them, though" This image has traditionally been based on LTS ubuntu, and if you look at the CentOS derived version that hasn't been updated since 2014 (pokle/centos-baseimage), they chose not to include ca-certificates or hardly anything else. (I'm assuming that tianon/centos:6.5 does not install ca-certificates by default...) I'm sure many people use FROM phusion/baseimage but personally, even as a maintainer, I don't. I'd change the image source to whatever upstream of Ubuntu I'm preferring today, and probably build that from scratch too. The value in this image is not that it comes pre-built, it's that the build is tested and supported. /side tangent
nyrikki 9y ago
While not as small it is trivial to make an up-to-date debian base image (or Fedora/Arch) any time you want. If you care about security you probably don't want to use random unverified images anyway. $ sudo debootstrap stretch mydebian http://mirrors.kernel.org/debian/ $ cd mydebian $ sudo tar -c . | docker import - mydebian Plus you can add files to the system before taring etc... If you have significant work to do on an image a Dockerfile can often be far more complex than this method.