3 ms·
> if I am going to run some code from somewhere and I haven't read it, it goes in a container How does this work? Every single npm package has tons of dependen
by netdevphoenix 10mo ago
> if I am going to run some code from somewhere and I haven't read it, it goes in a container
How does this work? Every single npm package has tons of dependency tree nodes
- Lutger 10mo agoEverything runs in the container and cannot escape it. Its like a sandbox. You have to make sure you're not putting any secrets in the container environment.
- moffkalast 10mo agoAll right then, keep your secrets.
- mlnj 10mo ago>You have to make sure you're not putting any secrets in the container environment. How does this work exactly? containers still need env vars and access to databases and cloud environments. Without these the container is just useless isolated pod.
- jack_pp 10mo agoMaybe don't use JavaScript on the backend.
- lbhdc 10mo agoNot who you asked, but I have a similar setup. I can run everything I need for local development in that image (db, message queue emulator, cache, other services). So, setting things like environment variables or running postgres work the same as they do outside the container. The image itself isn't the same image that the app gets deployed in, but is a portable dev environment with everything needed to build and run my apps baked in. This comes with some nice side effects like being able to instantly spin up clean work environments on my laptop, someone elses, or a remote vm.
- Lutger 10mo agoThis really depends on your setup. If possible, I have local development containers as much as possible. nginx, postgres, redis, etc. I have several containers, each only has access to what it needs. We have an isolated cloud environment for development, in its own aws account. Its not going to stop attacks, but it will limit blast radius a lot.
- roozbeh18 10mo agoYou are just reducing the blast radius with use of podman; you will likely need secrets for your app to work, which will be exposed regardless of the podman approach.
- deleted 10mo ago[deleted]
- Aeolun 10mo agoMost people don’t have NPM keys in their application containers.
- XorNot 10mo agoIf you're developing in a container then you would have to be doing it without doing something like say, mounting your home directory into it. The reality here is this is the sort of attack SELinux should be good at stopping (it's not because no one uses SELinux, the policies most commonly used don't confine the user profile in a useful way, and a whole bunch of tools love ambient credentials in environment variables).
- eyberg 10mo agoNo it is not.
- swsieber 10mo agoI didn't read this as separate containers.