3 ms·
when it works for containers, it would have worked just the same for shared lib, but with one less step. containers: update the lib, rebuild. sane software: u
by gcb0 9y ago
when it works for containers, it would have worked just the same for shared lib, but with one less step.
containers: update the lib, rebuild.
sane software: update the lib.
now, to the complicated case which containers claim to solve, when the lib update breaks compatibility.
container: update lib, application dont compile, leave like that because we think we are not vulnerable anyways.
sane sotware: update lib, application break, have to fix application because shared lib will be updated no matter what.
- AluminiumPoint 9y agoSort of. You are missing the ephemeral of containers, which has a net security advantage. Ephemeral containers mean that its harder for an attacker to obtain persistence, and easier to cycle out and swap bad containers than it is to patching servers. I would argue that container orchestration infrastructure is objectively more secure than plain old servers; I get where you are coming from, but this tech is solving real problems, the cool aid is good
- gcb0 9y agowith shared libraries containers are an option just fine