Re:Exploiting Alpine Linux
by Gigablah on Monday July 17, 2017 @02:48PM
(#14791287)
I don't understand your conclusion. The exploit in the article was reported to the Alpine Linux maintainers and the fix was promptly made to apk-tools (https://git.alpinelinux.org/cgit/aports/commit/?id=b849b481a...), so if you rebuilt a docker image based off Alpine you'd have gotten the security update like you described.
[ Parent
| on HN ]
Re:Exploiting Alpine Linux
by mschuster91 on Tuesday July 18, 2017 @02:26AM
(#14794608)
> so if you rebuilt a docker image based off Alpine you'd have gotten the security update like you described.
Only if I directly base off my image from Alpine. All images that base off something that either directly bases off Alpine (or worse, with more intermediaries) have a problem as ALL images in the chain must be rebuilt.
That is the core problem.
TBH you'd have the same problem if you based your image off an intermediate Debian/Ubuntu-based image.
I always build my images directly off Alpine anyway, or a base image that I control.
(In this case though, the security fix is for the apk-tools package and not the distro itself, so as long as you have apk update+upgrade in your final build, whether the intermediate images are rebuilt doesn't matter.)