3 ms·
docker-slim is incredibly dangerous and should never be used for a production app.
by mplewis 4y ago
docker-slim is incredibly dangerous and should never be used for a production app.
- nicce 4y agoI guess the question is in which way dangerous? It might lead for crash for sure, but is that crash controlled? If it is, then it is just a crash. Stability vs. minimal attack surface But I agree, this is just bandaid for lazy bois. Better use Bazel etc. for distroless builds
- mplewis 4y agoThis is dangerous in that it strips assets, resources, and files from your app without understanding how they are used. If you forget a critical code path when you build using Docker-Slim, and a resource file is not used, that resource will be stripped. The feature which depends on it will be broken in production.
- bigpod 4y agoi would disagree i use em in production apps, i configured it and it works if you do it blindly it happens that sometimes things break but if you configure it, it will work
- mplewis 4y agoThere is no guarantee that a blind code shaker will leave in everything important while stripping out everything that isn't. How could it possibly know? If Docker-Slim is working for you in production apps, you are either getting lucky or your app is trivial enough to lack unseen code paths.
- tyingq 4y agoMaybe even unforseen files outside of your app, right? Like, maybe some log forwarder utility that only gets called for "CRIT" messages that didn't happen to get triggered by testing.