Honest question: Do you know if Alpine ships patches to substantial vulnerabilities more quickly than Debian and/or Ubuntu? Thanks!
I don't know the answer to this, but I do know that Alpine has some really awesome stuff around vulnerabilities, and I would presume that they react to vulnerabilities more quickly.
However, I intend to validate this presumption in a future project.
Thank you! I'd love to hear your findings.
Absolutely. I intended this post to identify (some of) the problems/challenges. My next post will focus on how to address them.
Alpine is definitely one of the major points, as well as static binary images and some advice on Dockerfile configuration.
If you can I'd recommend this as a good practice to reduce these kinds of problems. The fundamental fact is that if you don't have a library installed, you can't be affected by a vulnerability in it. So the smaller your image, the fewer possible avenues for shipping vulnerable libs you'll have and you'll have to spend less time re-building images with updated packages.