3 ms·
Go binaries are not entirely self contained. Even when fully statically linked (and there are several options to still use libc features) they use the certifica
by justincormack 6y ago
Go binaries are not entirely self contained. Even when fully statically linked (and there are several options to still use libc features) they use the certificates from the filesystem and a fee other files. So if you want full control you should ship these too.
- johannes1234321 6y ago> they use the certificates from the filesystem [...] if you want full control Bow the question is who that "you" is. As the the one running it I have less control and a harder time updating those and depend more on the developer providing those.
- mikepurvis 6y agoContainers are more than just FS isolation— there's a convenience piece here where someone might like it in a lightweight container for the sake of sane integration with higher level orchestration, management of resources like ports, storage, etc. In your case, it may be that these aren't considerations, and you'd prefer to just run the binary directly against your bare system.
- johannes1234321 6y agoOh, I love containers and do most my work in them. However I also mind that that production needs are different than developer needs and have seen too many cases where containers made security audits (a new openssl update - where do I have to apply it?) hard ... and certificates triggered me ;)
- ImJasonH 6y agoYep! By default ko bases images on gcr.io/distroless/static:nonroot which provides certs and other necessary basics, all in a nice tidy package.