4 ms·

I would rather install the needed libraries myself and not have to deal with tons of security fixes of libraries I don't use.

curiousgal 5y ago
I mean honestly if you're that paranoid then you shouldn't be using Docker in the first place.
- aledalgrande 5y ago
  What does docker have to do with patching security fixes? If you have an EC2 box it's going to be the same. I don't consider that paranoid.
  - xyzzy_plugh 5y ago
    This is not a valid comparison. You're comparing bare metal virtual machines wherein you are responsible for all of the software running on the VM, with a bundled set of tarballs containing binaries you probably cannot reproduce. Many, many vendors provide docker images but no Dockerfile. And even if you had the Dockerfile you might not have access to the environment in which it needs to be run. Docker is successful in part because it punts library versioning and security patches and distro maintenance to a third party. Not only do you not have to worry about these things (but you should!) now you might not be able to even do anything if you wanted to.
    - prmoustache 5y ago
      > Docker is successful in part because it punts library versioning and security patches and distro maintenance to a third party. Not only do you not have to worry about these things (but you should!) now you might not be able to even do anything if you wanted to. This is a very restricted view. Besides this article is about building your own images, not using existing ones.
coredog64 5y ago
Once you start adding stuff, I think Alpine gets worse. For example, there’s a libgmp issue that’s in the latest Alpine versions since November. It’s fixed upstream but hasn’t been pulled into Alpine.
CJefferson 5y ago
Do libraries just sat there on disc do any damage? Also, are you going to update those libraries as soon as a security issue arises? Debian/Ubuntu and friends have teams dedicated to that type of thing.
- postalrat 5y ago
  Can they be used somehow? They perhaps. Depending where you work you might also need to pass some sort of imaging scan that will look at the versions of everything installed.
pas 5y ago
musl DNS stub resolver is "broken" unfortunately (it doesn't do TCP, which is a problem usually when you want to deploy something into a highly dynamic DNS-configured environment, eg. k8s)
erik_seaberg 5y ago
That’s rolling your own distro. We could do that but it’s not really our job. It also prevents the libraries from being shared between images, unless you build one base layer and use it for everything in your org (third parties won’t).

curiousgal 5y ago

I mean honestly if you're that paranoid then you shouldn't be using Docker in the first place.

aledalgrande 5y ago
What does docker have to do with patching security fixes? If you have an EC2 box it's going to be the same. I don't consider that paranoid.
- xyzzy_plugh 5y ago
  This is not a valid comparison. You're comparing bare metal virtual machines wherein you are responsible for all of the software running on the VM, with a bundled set of tarballs containing binaries you probably cannot reproduce. Many, many vendors provide docker images but no Dockerfile. And even if you had the Dockerfile you might not have access to the environment in which it needs to be run. Docker is successful in part because it punts library versioning and security patches and distro maintenance to a third party. Not only do you not have to worry about these things (but you should!) now you might not be able to even do anything if you wanted to.
  - prmoustache 5y ago
    > Docker is successful in part because it punts library versioning and security patches and distro maintenance to a third party. Not only do you not have to worry about these things (but you should!) now you might not be able to even do anything if you wanted to. This is a very restricted view. Besides this article is about building your own images, not using existing ones.

coredog64 5y ago

Once you start adding stuff, I think Alpine gets worse. For example, there’s a libgmp issue that’s in the latest Alpine versions since November. It’s fixed upstream but hasn’t been pulled into Alpine.

CJefferson 5y ago

Do libraries just sat there on disc do any damage? Also, are you going to update those libraries as soon as a security issue arises? Debian/Ubuntu and friends have teams dedicated to that type of thing.

postalrat 5y ago
Can they be used somehow? They perhaps. Depending where you work you might also need to pass some sort of imaging scan that will look at the versions of everything installed.

pas 5y ago

musl DNS stub resolver is "broken" unfortunately (it doesn't do TCP, which is a problem usually when you want to deploy something into a highly dynamic DNS-configured environment, eg. k8s)

erik_seaberg 5y ago

That’s rolling your own distro. We could do that but it’s not really our job. It also prevents the libraries from being shared between images, unless you build one base layer and use it for everything in your org (third parties won’t).