News for hackers. Stuff that matters.

A comment on 51% of 4M Docker images have critical vulnerabilities. Parent comment

Re:51% of 4M Docker images have critical vulnerabilities by feinte on Thursday December 17, 2020 @08:57AM (#25455581)
The problem lies in baking entire distribution into an image.

Using distroless images or "FROM scratch" with statically compiled app reduces the risks.

You still have to watch for your app dependencies updates but that's less work than for an entire distribution.

[ Parent | on HN ]
Re:51% of 4M Docker images have critical vulnerabilities by mattgreenrocks on Thursday December 17, 2020 @11:40AM (#25457182)
Huh, I didn't know that was possible. So you could specify an app container that is then overlaid atop the OS container?

I suppose installing the dependencies ends up being easier if you know they'll end up in, e.g. a ubuntu 18.04 image, hence that's what people do.

[ Parent | on HN ]