3 ms·

Python's also not installed by default in (most?) official docker images.

• shagie 2y ago
  Docker images fill a different role. They shouldn't have everything installed on them as that broadens the attack footprint. They should be doing one thing, and one thing only. If it's a "run this executable that was built" - then only what is needed should be there. Installing python and other general purpose tools gives any attacker that gets into a docker container many more tools to work with for getting out. For docker, the trend isn't "build a general purpose machine" but rather "what can we slim this down to that only has the bare minimum in it?" This can be taken all the way to the distroless images ( https://github.com/GoogleContainerTools/distroless https://github.com/GoogleContainerTools/distroless ) and means that the security team won't be asking you to fix that CVE that's in Python that you don't use. If, however, you do need python in an image because that image's purpose is to do some python, then you can pull a python image that has the proper release.