3 ms·
Luckily most of those vulnerabilities will be dormant, impossible to reach and exploit. Hopefully. I don't think there's going to be any change in how people
by willvarfar 5y ago
Luckily most of those vulnerabilities will be dormant, impossible to reach and exploit. Hopefully.
I don't think there's going to be any change in how people package containers. So perhaps what is needed is a dependency-walking Link-Time-Optimization-like tool that can trim down, perhaps by masking rather than removing, the dead code?
- iximiuz 5y agoI still have a hope that increasing awareness of the problem may eventually lead to a reduction in the number of Dockerfiles starting `FROM <something_huge_and_not_really_needed>`.
- dspillett 5y ago> Luckily most of those vulnerabilities will be dormant, impossible to reach and exploit. Hopefully. Our people who use docker for some of our infrastructure have taken to using locally rolled images (from scratch or by updating official ones) for this reason. I don't think any of the issues found when we scanned were actually exploitable in our config, but we need to be a bit more careful than just hoping (due diligence & security-in-depth and all that - an unknown flaw elsewhere could expose one of the issues and that in turn allow some form of DoS, data exfiltration, or arbitrary code execution). We were surprised how much excess stuff, much of it out of date, is in some official images. Sometimes even the required dependencies seemed slower to be updated than we would prefer.