3 ms·
So a container that, say, builds nginx from source and doesn't delete the source tree is considered full of dark matter because so many files are not installed
by choeger 4y ago
So a container that, say, builds nginx from source and doesn't delete the source tree is considered full of dark matter because so many files are not installed from the package manager?
That appears to be a difficult definition.
- Programmatic 4y agoThe answer to that would be to make a builder image and copy out the installed files. That makes a smaller container anyhow so has several advantages.
- dlor 4y agoBasically yes - unless you also keep enough metadata around somewhere for a scanner to know what version of nginx is installed. This can be done out-of-band with an SBOM, or in-band by using package manager metadata.