4 ms·
Removing as many layers as possible is one way to mitigate this: adding a static binary in a `FROM scratch` container, for example, where all libraries are comp
by conradev 9y ago
Removing as many layers as possible is one way to mitigate this: adding a static binary in a `FROM scratch` container, for example, where all libraries are compiled from sources that you verify the best you can.
- pm90 9y agoLove this comment. And especially with compiled languages like Go and the multiple build stages feature in Dockerfiles, this makes it incredibly easy to do just that.
- conradev 9y agoOne thing I forgot to mention is that you are still trusting trust – the builder needs to be verified for the output to be verified.