Setting Up a Software Development Environment on Alpine Linux

Re:Setting Up a Software Development Environment on Alpine L... by catern on Tuesday March 19, 2019 @09:06PM (#19437897)

It's quite ironic that the biggest usage of Alpine, a distro whose tagline is "Alpine Linux is a security-oriented, lightweight Linux distribution based on musl libc and busybox.", is Docker, which is an almost completely opposite technology: vastly overcomplicated, insecure, and bloated. I'd be interested to hear what the Alpine maintainers think of their biggest user...

[ Parent | on HN ]

Re:Setting Up a Software Development Environment on Alpine L... by jcrites on Tuesday March 19, 2019 @09:58PM (#19438175)

> I'd be interested to hear what the Alpine maintainers think of their biggest user...

The creator of Alpine Linux, Natanael Copa, reportedly went to work for Docker, so presumably Natanael thinks it's a reasonable use-case. Solomon Hykes, Docker's CTO at the time, posted about it on HN: https://news.ycombinator.com/item?id=11000827

Alpine Linux, as I understand it, strives to be a lightweight and minimalist distribution of Linux. That's exactly what you'd want to run as a container, assuming you are going to run a Linux distribution and one that's different than the production host system.

[ Parent | on HN ]

Re:Setting Up a Software Development Environment on Alpine L... by closeparen on Tuesday March 19, 2019 @09:52PM (#19438145)

Aren’t minimalist operating systems often meant to run as guests under more complicated virtualization layers? Limited driver support, for example, can be an important part of the minimalism.

[ Parent | on HN ]

Re:Setting Up a Software Development Environment on Alpine L... by aero142 on Tuesday March 19, 2019 @09:38PM (#19438078)

People believe that security is like salt. Just sprinkle it on top and it somehow makes the whole thing better.

[ Parent | on HN ]

Re:Setting Up a Software Development Environment on Alpine L... by dahfizz on Tuesday March 19, 2019 @10:37PM (#19438384)

It could be fair to call the docker ecosystem bloated and insecure, but I would argue that a single (Alpine based) docker container is a secure, simple, and elegant solution.

[ Parent | on HN ]

Re:Setting Up a Software Development Environment on Alpine L... by hjk05 on Wednesday March 20, 2019 @04:10AM (#19439967)

Docker is vastly over complicated? It’s one file jotting down a setup, and two commands, build and run and your up and going. How could it possibly be simpler? Bloated? It takes up almost no space and the docker image containers in large part thanks to alpine run less than 50MiB unless you are using huge dependencies at which point there is no way around it anyway. As for insecure, what’s the issue? We’re running untrusted code in containers and have had no issues but I’d love to hear where the model breaks down.

[ Parent | on HN ]

Re:Setting Up a Software Development Environment on Alpine L... by raesene9 on Tuesday March 19, 2019 @10:16PM (#19438277)

out of curiousity, where you say Docker is "insecure" what specific aspects of Docker were you thinking of?

[ Parent | on HN ]

Re:Setting Up a Software Development Environment on Alpine L... by lojack on Wednesday March 20, 2019 @12:25AM (#19438982)

The docker daemon runs as a privileged user, so if you're able to break out of the container (which has been shown possible recently) then you can compromise the entire host OS.

[ Parent | on HN ]

Re:Setting Up a Software Development Environment on Alpine L... by hjk05 on Wednesday March 20, 2019 @04:13AM (#19439980)

Could you provide a reference for how to break our?

[ Parent | on HN ]

Re:Setting Up a Software Development Environment on Alpine L... by lojack on Wednesday March 20, 2019 @09:25AM (#19441844)

https://www.twistlock.com/labs-blog/breaking-docker-via-runc...

This is from a CVE that was released a little over a month ago.

[ Parent | on HN ]

Re:Setting Up a Software Development Environment on Alpine L... by raesene9 on Wednesday March 20, 2019 @06:58PM (#19447839)

That was a runc vuln, which affected other conatinerization solutions on Linux, not just docker.

Also it didn't really have anything to do with the Docker daemon running as root, it was triggered by the use of root users in containers (blocked if the user didn't do that, had decent SELinux setups or used user namespaces)

[ Parent | on HN ]