4 ms·

I see it as the opposite. If the maintainer of the container put some effort in, everyone could have a secure version of their software with minimal effort. Th

• jtheory 11y ago
  The problem is that "secure version" is a constantly moving target; the taskforce would need to go around once a month (or whenever there's an urgent vulnerability discovered) and update apps that needed it. If Docker apps were somehow integrated with maintained Linux repos, this could be possible by default -- e.g., all Docker images built on Debian stable dependencies would have their internal dependencies auto-upgraded with each Debian stable sub-release, and possibly be flagged as "needs human intervention" on major releases. Have there been efforts to do anything like this? I'm new to the Docker world.... There needs to be, though, otherwise a "secure app" is always a temporary creation.
• drzaiusapelord 11y ago
  >The trick is to get people to care about their security. Its 2015. If security isn't a priority by a project, then that project is just incompetent. That may be harsh sounding, but are we really talking about security as optional with internet facing services? This is what happens when devs build their own systems without the experience of being a sysadmin. There's a lot of kitchen sink and duct tape "does it work? Yes, then we're done," mentalities at play here. Not enough people are worrying about maintainability and upgradability. Heck, most of these things ship with everything running as root. Its like we've regressed to the 90s with Docker and Docker-like technologies.