Hacker News

points by Shish2k 1 day ago | 0 comments

Yes - difficulty in shipping security updates to a hundred different container images, each of which is vulnerable in their own slightly-different way because they all decided to ship an OS alongside their app - is one of the top criticisms of the docker way of doing things

[–] stephbook 1 day ago

Just run it in kubernetes and mount the certificates with trust-manager

[–] paulddraper 1 day ago

> just

> kubernetes

[–] gchamonlive 6 hours ago

If it were 5 years ago I'd have the same reaction, but today it's fairly simple to setup a single node deployment with minikube or k3s, and LLM makes it very easy to maintain deployments.

[–] musicale 1 day ago

> docker

If only we could somehow share libraries and configuration files across apps rather than duplicating them and having to update them for every app individually.

We could call it a "shared library" system and an "operating" system. Someone should really invent this.

I mean, even docker could maybe use a shared base image or something right? ;-)

[–] mixedCase 1 day ago

Now make it immutable and layered, like Docker images, and you might be onto something... Ah well, sounds too good to be true. We might have to nix the idea.

[–] mikepurvis 15 hours ago

Should it also predate Docker by a decade? That would be crazy.

[–] xp84 1 day ago

What kind of psychopath ships 100 distinct container images? I mean, maybe if you’re talking about all of Netflix or something, but… I suspect even they have base images that they use as a starting point.

There’s very little actually running in a docker container. ca-certs may actually be an exceptional case though, since it’s not code that’s running but a kind of data.

It’s not like if you use an Ubuntu image for a node.js app that you get PHP too and have the PHP vulnerability present in your web app.

[–] stackskipton 1 day ago

You still have to rebuild each Application Container with new CACert and deploy them. Depending on teams are working, that can be disruptive.

[–] anamexis 1 day ago

I would say that if rebuilding your docker containers is a disruptive process, that is a process issue.

[–] stackskipton 1 day ago

I would agree but it doesn't change the fact that many companies do not have CD and have processes that must be followed for rollouts.

It's same problem we have when libraries get massive security vulnerabilities. Updating them is not always as easy as many would like.

[–] mikepurvis 12 hours ago

I think the number one thing that bites a lot of container workflows is when you have a separate "base image" build that depends on external, mutable package sources using tools that don't support locking, such as apt.

This gets worse for each additional such layer, for example if you start from ubuntu:whatever and have a system deps layer, then an application deps layer, then static assets, then your app's code. Unless you think about it upfront when designing the pipeline, it can be challenging to trace all that state backwards and figure out how to safely re-build thing-from-x-weeks ago but with a single unsafe package bumped forward.

Every shop with competent devops people present should be set up for this, but it usually doesn't come for free.

[–] GoblinSlayer 22 hours ago

AFAIK a container build just puts files into a base image, this creates a sort of a commit chained to the base image commit. This means to update the base image you only need to rebase that commit on top of the new base image branch automatically.

[–] notpushkin 19 hours ago

I haven’t seen tooling for rebasing OCI images yet. Considering you’d still have to do this and roll it out to the server, you can just re-run the CI, which would build the image again, but also test that it works with the new base image.