Inside Docker's “FROM scratch”

Re:Inside Docker's “FROM scratch” by Intermernet on Monday November 27, 2017 @05:32AM (#15786314)

Works just as well for Go binaries. It's pretty much the recommended base image for distribution of Go apps on Docker. I assume that it would be just as effective for any statically compiled binary.

Edit: I really should have read the article first. It uses Go binaries as the example. Good to know Haskell folks are also using it.

[ Parent | on HN ]

Re:Inside Docker's “FROM scratch” by rmoriz on Monday November 27, 2017 @05:33AM (#15786323)

Massive downside: You run your app as root or you have to do nasty mounts of /etc/passwd and /etc/group from your host

[ Parent | on HN ]

Re:Inside Docker's “FROM scratch” by lizxrice on Monday November 27, 2017 @07:52AM (#15786894)

You don't have to mount the host versions - you can create container-specific ones.

See https://medium.com/@lizrice/non-privileged-containers-based-...

[ Parent | on HN ]

Re:Inside Docker's “FROM scratch” by Intermernet on Monday November 27, 2017 @05:44AM (#15786368)

You can run a Docker container as a particular user.

https://docs.docker.com/engine/reference/builder/#user

You can use `setcap` to grant capabilities to the binary or the `pam_cap` module if you need to do capabilities per user.

I haven't run across the need to run most containers as root for a while now.

[ Parent | on HN ]

Re:Inside Docker's “FROM scratch” by embano1 on Monday November 27, 2017 @07:03AM (#15786684)

Yup, in the end it´s an OS process and all rules apply. I did not care too much about Dockerfile best practices in my article. Good point, should at least have used "user <!root>".

[ Parent | on HN ]