4 ms·

>once the product is in maintenance no one is going to be updating them. That's not a container specific problem. That happens even when you don't use containe

• sedachv 9y ago
  There is a lot of misleading marketing hype, misunderstanding, and plain misinformation about how containers/Docker make updates, and in particular security updates, easier, when the opposite is the reality. A lot of people buy into the CoreOS marketing hype, as though it was the only Linux distribution to offer automatic security updates. If you use containers as recommended, in fact the only thing CoreOS gives you are kernel updates, which is less than what other distributions provide. To get userland updates with Docker, you have to update your base image, then rebuild and re-deploy your application image, for every single application that you have. Or use custom kludge layers for updates: https://github.com/SUSE/zypper-docker https://github.com/SUSE/zypper-docker https://github.com/projectatomic/rpm-ostree https://github.com/projectatomic/rpm-ostree Making maintenance and updates harder is definitely a container specific problem.
• jeremyjh 9y ago
  Many organizations have operations teams that are responsible for ensuring servers get patched on a regular schedule, and there is an entire industry of software to confirm whether or not they are doing it properly. But I know for a fact that at some of these same organizations, the deployable unit is a Docker image that the development team pushes to the repository when it suits them. Operations doesn't have the ability to patch the software in the container, and the auditing tools haven't caught up either.