4 ms·

It's well documented that Docker and especially docker hub had a terrible impact on security. Once you factor in the efforts required in the long term to mitig

It's well documented that Docker and especially docker hub had a terrible impact on security. Once you factor in the efforts required in the long term to mitigate a decade of bundling gigabytes of applications and libraries it's a huge "dev adventure"

oauea 5y ago
Just build your own images like you would otherwise install the software on bare metal. Base those images on official images, not community images.
- kryptk 5y ago
  YMMV. Personally, you would have to pry my Bitnami images out of my cold dead hands.. there is just no way my team of 2 can do anywhere near as good.
  - oauea 5y ago
    Fair, there are a few high quality "vendors" that we also trust, and Bitnami is one of them. RandomJoe42/SomeImage is out, though.
- goodpoint 5y ago
  > Just build your own images This is like saying "just wear a mask": it's not enough. You rely on what other people are doing now and what they've done in the past. This is an ecosystem problem, not an an individual problem.
Frost1x 5y ago
More like developer Towers of Babel waiting to collapse on every build attempt. Docker is fine if it's used correctly but it does add a layer of complexity, it doesn't abstract it away.. The way I see it rampantly (ab)used is as a shortcut to get some software up and running by leveraging a public image and passing tech debt for some component of one's system onto the maintainer of the Docker image, then cobbling together multistage builds from those and microservice architectures to try and support this tech debt model. Sometimes it works, many times it breaks, often it turns into complete and utter nightmares to deal with. "Amazing Andy got this fantastically complex system up and running in a week all by their self way under time and budget and it works. Now I just want to add this feature or modify this one thing and you're telling me that's going to take how long?" Yea, I've seen this more times than I care to admit.
- kwertyoowiyop 5y ago
  “You mean Amazing Architect Andy who just left for Google?” :-(
  - KronisLV 5y ago
    That's at least partially why we have CV driven development be a thing in the industry. Either you jump on the NoSQL, AI, ML, blockchain, serverless, microservice, container, $FOO bandwagons, or you'll miss out on job opportunities and will have your CV stagnate. That's not to say that those technologies don't have good use cases in particular circumstances, it's just that you as an IC probably don't have strong incentives to care about where the project will be in 5-10 years when you will have left for another company in 2-3. A lot of accidental complexity is an unavoidable reality when you have people who put their own careers ahead of most other concerns.

oauea 5y ago

Just build your own images like you would otherwise install the software on bare metal. Base those images on official images, not community images.

kryptk 5y ago
YMMV. Personally, you would have to pry my Bitnami images out of my cold dead hands.. there is just no way my team of 2 can do anywhere near as good.
- oauea 5y ago
  Fair, there are a few high quality "vendors" that we also trust, and Bitnami is one of them. RandomJoe42/SomeImage is out, though.
goodpoint 5y ago
> Just build your own images This is like saying "just wear a mask": it's not enough. You rely on what other people are doing now and what they've done in the past. This is an ecosystem problem, not an an individual problem.

Frost1x 5y ago

More like developer Towers of Babel waiting to collapse on every build attempt. Docker is fine if it's used correctly but it does add a layer of complexity, it doesn't abstract it away.. The way I see it rampantly (ab)used is as a shortcut to get some software up and running by leveraging a public image and passing tech debt for some component of one's system onto the maintainer of the Docker image, then cobbling together multistage builds from those and microservice architectures to try and support this tech debt model. Sometimes it works, many times it breaks, often it turns into complete and utter nightmares to deal with. "Amazing Andy got this fantastically complex system up and running in a week all by their self way under time and budget and it works. Now I just want to add this feature or modify this one thing and you're telling me that's going to take how long?" Yea, I've seen this more times than I care to admit.

kwertyoowiyop 5y ago
“You mean Amazing Architect Andy who just left for Google?” :-(
- KronisLV 5y ago
  That's at least partially why we have CV driven development be a thing in the industry. Either you jump on the NoSQL, AI, ML, blockchain, serverless, microservice, container, $FOO bandwagons, or you'll miss out on job opportunities and will have your CV stagnate. That's not to say that those technologies don't have good use cases in particular circumstances, it's just that you as an IC probably don't have strong incentives to care about where the project will be in 5-10 years when you will have left for another company in 2-3. A lot of accidental complexity is an unavoidable reality when you have people who put their own careers ahead of most other concerns.