2 ms·
I use docker with go all the time. The only thing in container images I build are static binaries regardless of if it is C, rust, go, whatever. Static binaries
by lrvick 6y ago
I use docker with go all the time.
The only thing in container images I build are static binaries regardless of if it is C, rust, go, whatever. Static binaries don't defeat the point of containers, they are best practice. People that include bash and a package manager and such nonsense inside production containers huge complex and insecure for no reason.
The problem containers solve better than anything else are providing a simple API to take advantage of kernel security features that are a real pain to use otherwise.
User, process, and filesystem namespacing. System call filtering. Ensuring even if there is a remote exec exploit there is no bash or anything else in the container for an attacker to use.
If you think containers are only a software build and distribution tool then security is probably not even part of your thought process, and that is dangerous.
Ignore all the 99% of blog posts and tuturials on containers out there written by people who have never done any kind of system hardening.
They are mostly making your life harder and giving you nothing in return, as the author of this post points to.
- bennofs 6y ago> User, process, and filesystem namespacing. System call filtering. Ensuring even if there is a remote exec exploit there is no bash or anything else in the container for an attacker to use. All of these are supported by systemd out of the box. You can use `SystemCallFilter=...`, and various options to restrict the file system (like `ProtectHome` and `ProtectSystem`) plus tons of other linux kernel features (capabilities, no new privileges).
- lrvick 6y agoFair point, but there is also no portable spec for this that works beyond systemd and there are plenty of cases where systemd is not desirable. Maybe you want to run on an embedded system, or a hardened immutable system where you don't actually need bash and coreutils etc. The OCI spec gives us all these features in a compact and portable package independent of any particular init system while also providing a way to verify and update images with signature verification over a network so you need not even have attack surface like ssh to manage updates. Don't get me wrong, I love systemd for my desktop, however for servers I don't want a single binary present that isn't strictly nessesary for my target binary to function as it just gives adversaries a foothold.