4 ms·
If you can build on your distro of choice, you can rely on the same security audit and process. Keep track of the packages you link against and include in your
by hvidgaard 7y ago
If you can build on your distro of choice, you can rely on the same security audit and process. Keep track of the packages you link against and include in your image, and just rebuild your images when a new security update comes along. Then you replace the running one.
- dsr_ 7y agoSee that "keep track" bit? It's expensive unless you build a tool to do it for you -- which is what I said previously.
- hvidgaard 7y agoPulling the list of security updates is trivial. And during development you'll know what you depend on. Comparing the two in a script is trivial. But regardless, with containers, it should be a setup where you can rebuild your images daily with all the latest security fixes. Or whenever there is a fix you deem important.
- adamtulinius 7y agoYou don't have to keep any more track than you do with your OS; it's just a different button you hit when updating containers. Or don't keep track at all: Just rebuild and redeploy often enough.