3 ms·
I recently asked for a Dockerfile that builds an image which passes Docker's vulnerability scan. It gave me a file that failed over a dozen vulnerability tests.
by surfingdino 2y ago
I recently asked for a Dockerfile that builds an image which passes Docker's vulnerability scan. It gave me a file that failed over a dozen vulnerability tests.
- simonw 2y agoDid you paste the test failures back into it to see what it did about them? (This is the kind of test I'd expect it to fail at because of its knowledge cut-off - vulnerability scans are mostly looking for things like out-of-date packages, so any tool with a knowledge cut-off a few months in the past is very likely to include package versions that would no longer pass a scanner)
- surfingdino 2y agoI googled, found the solution I was looking for. Zero vulnerabilities. Can't be arsed with training LLMS, writing a Dockerfile for my project was one of many little steps that I have no desire to turn into training sessions for an LLM.
- djeastm 2y agoMay be the pink elephant problem. If you pass the word "vulnerability" maybe it's going to return results that are linked to vulnerabilities.
- surfingdino 2y agoThis is fine for LLM fans, not for general user. I don't need more problems to solve.