4 ms·

It's quite ironic that the biggest usage of Alpine, a distro whose tagline is "Alpine Linux is a security-oriented, lightweight Linux distribution based on musl

by catern 8y ago

It's quite ironic that the biggest usage of Alpine, a distro whose tagline is "Alpine Linux is a security-oriented, lightweight Linux distribution based on musl libc and busybox.", is Docker, which is an almost completely opposite technology: vastly overcomplicated, insecure, and bloated. I'd be interested to hear what the Alpine maintainers think of their biggest user...

aero142 8y ago
People believe that security is like salt. Just sprinkle it on top and it somehow makes the whole thing better.
closeparen 8y ago
Aren’t minimalist operating systems often meant to run as guests under more complicated virtualization layers? Limited driver support, for example, can be an important part of the minimalism.
jcrites 8y ago
> I'd be interested to hear what the Alpine maintainers think of their biggest user... The creator of Alpine Linux, Natanael Copa, reportedly went to work for Docker, so presumably Natanael thinks it's a reasonable use-case. Solomon Hykes, Docker's CTO at the time, posted about it on HN: https://news.ycombinator.com/item?id=11000827 https://news.ycombinator.com/item?id=11000827 Alpine Linux, as I understand it, strives to be a lightweight and minimalist distribution of Linux. That's exactly what you'd want to run as a container, assuming you are going to run a Linux distribution and one that's different than the production host system.
raesene9 8y ago
out of curiousity, where you say Docker is "insecure" what specific aspects of Docker were you thinking of?
- lojack 8y ago
  The docker daemon runs as a privileged user, so if you're able to break out of the container (which has been shown possible recently) then you can compromise the entire host OS.
  - hjk05 8y ago
    Could you provide a reference for how to break our?
    - lojack 8y ago
      https://www.twistlock.com/labs-blog/breaking-docker-via-runc-explaining-cve-2019-5736/ https://www.twistlock.com/labs-blog/breaking-docker-via-runc... This is from a CVE that was released a little over a month ago.
      - raesene9 8y ago
        That was a runc vuln, which affected other conatinerization solutions on Linux, not just docker. Also it didn't really have anything to do with the Docker daemon running as root, it was triggered by the use of root users in containers (blocked if the user didn't do that, had decent SELinux setups or used user namespaces)
dahfizz 8y ago
It could be fair to call the docker ecosystem bloated and insecure, but I would argue that a single (Alpine based) docker container is a secure, simple, and elegant solution.
hjk05 8y ago
Docker is vastly over complicated? It’s one file jotting down a setup, and two commands, build and run and your up and going. How could it possibly be simpler? Bloated? It takes up almost no space and the docker image containers in large part thanks to alpine run less than 50MiB unless you are using huge dependencies at which point there is no way around it anyway. As for insecure, what’s the issue? We’re running untrusted code in containers and have had no issues but I’d love to hear where the model breaks down.

by catern 8y ago

aero142 8y ago

People believe that security is like salt. Just sprinkle it on top and it somehow makes the whole thing better.

closeparen 8y ago

Aren’t minimalist operating systems often meant to run as guests under more complicated virtualization layers? Limited driver support, for example, can be an important part of the minimalism.

jcrites 8y ago

> I'd be interested to hear what the Alpine maintainers think of their biggest user... The creator of Alpine Linux, Natanael Copa, reportedly went to work for Docker, so presumably Natanael thinks it's a reasonable use-case. Solomon Hykes, Docker's CTO at the time, posted about it on HN: https://news.ycombinator.com/item?id=11000827 https://news.ycombinator.com/item?id=11000827 Alpine Linux, as I understand it, strives to be a lightweight and minimalist distribution of Linux. That's exactly what you'd want to run as a container, assuming you are going to run a Linux distribution and one that's different than the production host system.

raesene9 8y ago

out of curiousity, where you say Docker is "insecure" what specific aspects of Docker were you thinking of?

lojack 8y ago
The docker daemon runs as a privileged user, so if you're able to break out of the container (which has been shown possible recently) then you can compromise the entire host OS.
- hjk05 8y ago
  Could you provide a reference for how to break our?
  - lojack 8y ago
    https://www.twistlock.com/labs-blog/breaking-docker-via-runc-explaining-cve-2019-5736/ https://www.twistlock.com/labs-blog/breaking-docker-via-runc... This is from a CVE that was released a little over a month ago.
    - raesene9 8y ago
      That was a runc vuln, which affected other conatinerization solutions on Linux, not just docker. Also it didn't really have anything to do with the Docker daemon running as root, it was triggered by the use of root users in containers (blocked if the user didn't do that, had decent SELinux setups or used user namespaces)

dahfizz 8y ago

It could be fair to call the docker ecosystem bloated and insecure, but I would argue that a single (Alpine based) docker container is a secure, simple, and elegant solution.

hjk05 8y ago

Docker is vastly over complicated? It’s one file jotting down a setup, and two commands, build and run and your up and going. How could it possibly be simpler? Bloated? It takes up almost no space and the docker image containers in large part thanks to alpine run less than 50MiB unless you are using huge dependencies at which point there is no way around it anyway. As for insecure, what’s the issue? We’re running untrusted code in containers and have had no issues but I’d love to hear where the model breaks down.