4 ms·
You are screwed either way. If you don't update your container has a ton of known security issues, if you do the container is not reproducable. reproducable is
by bluGill 7mo ago
You are screwed either way. If you don't update your container has a ton of known security issues, if you do the container is not reproducable. reproducable is neat with some useful security benefits, but it is something a non goal if the container is more than a month old - day might even be a better max age.
- dev_l1x_be 7mo agoI update my docker containers regularly but doing it in a reproducible, auditable, predictable way
- tom1337 7mo agoCould you explain how you achieve this?
- oefrha 7mo agoChainguard, Docker Inc’s DHI etc. There’s a whole industry for this.
- beart 7mo agoIf you are on github/gitlab, renovate bot is a good option for automating dependency updates via PRs while still maintaining pinned versions in your source.
- dev_l1x_be 7mo agohave a multi layer build system where there is version of each layer. Example - linux base: kernel + libc + some low tooling - jvm base: adding the JRE/JDK you need - your application version
- tosti 7mo agoWhy is there a need for a package manager inside a container at all? Aren't they supposed to be minimal? Build your container/vm image elsewhere and deploy updates as entirely new images or snapshots or whatever you want. Personally I prefer buildroot and consider VM as another target for embedded o/s images.
- AntiUSAbah 7mo agoSo if i have a docker container which needs a handful of packages, you would handle it how? I'm handling it by using a slim debian or ubuntu, then using apt to install these packages with necessary dependencies. For everything easy, like one basic binary, I use the most minimal image but as soon as it gets just a little bit annoying to set it up and keep it maintained, i start using apt and a nightly build of the image.
- chaps 7mo agoYour question feels insane to me for production environments. Why aren't you doing a version cutoff of your packages and either pulling them from some network/local cache or baking them into your images?
- arandomhuman 7mo agoAforementioned security vulnerabilities don’t strike as a potential reason to you?
- chaps 7mo agoFriend, considering the supply chain attacks going on these days, automatically updating everything, immediately, probably isn't the perfect move either.
- askl 7mo agoIgnoring the real benefits of security updates to prevent the unlikely event of supply chain attacks sounds like a weird tradeoff.
- chaps 7mo agoA weird tradeoff but an increasingly important tradeoff to keep in mind nonetheless. Like I said, updating immediately isn't a perfect answer. But neither is waiting. I hope you're having this discussion, at least.
- teaearlgraycold 7mo agoFor some scenarios simply building a new image every day is reasonable.