3 ms·

One point that's not been addressed in your other replies is that Docker images should be a lot smaller than a "real" server so there should be fewer issues to

One point that's not been addressed in your other replies is that Docker images should be a lot smaller than a "real" server so there should be fewer issues to patch. If you base off a very minimal image (and make use of things like multi-stage builds to remove dev. tools from the image) you can get the package numbers down a lot. For the ultimate in low dependencies of course you can build off scratch and put a single statically linked binary into the image.

mmt 8y ago
> One point that's not been addressed in your other replies is that Docker images should be a lot smaller than a "real" server so there should be fewer issues to patch. Could you quantify this? It's possible to strip down a "real" server much farther than even what distros' "minimal" packages specify, which is why I wonder just how much smaller "a lot smaller" really is. I commented on a short sub-thread [1] discussing dependency bloat/radii of distros. One commentor quantified it in bytes, though perhaps a more meaningful number in this context would be number of packages. [1] https://news.ycombinator.com/item?id=17345982 https://news.ycombinator.com/item?id=17345982