News for hackers. Stuff that matters.

A comment on 51% of 4M Docker images have critical vulnerabilities. Parent comment

Re:51% of 4M Docker images have critical vulnerabilities by pjmlp on Thursday December 17, 2020 @09:49AM (#25456034)
They definitely are, because each jar/dll doesn't have the whole world inside itself.

Docker is like shipping EAR + Websphere + OS in one package.

[ Parent | on HN ]
Re:51% of 4M Docker images have critical vulnerabilities by oblio on Thursday December 17, 2020 @10:18AM (#25456302)
Yeah, I know, but you'd use the same mechanism for both.

For jars/dlls you look up dependency scanners and hook them up to your CI/CD.

For Docker images you look up image scanners and hook them up to your CI/CD.

[ Parent | on HN ]
Re:51% of 4M Docker images have critical vulnerabilities by thu2111 on Friday December 18, 2020 @07:25AM (#25466398)
Realistically a lot of Java apps are shipped as fat JARs that do in fact include the (Java) world.

Hot-patching apps to use newer versions of JARs because of security bugs, outside of the update stream of the actual app itself, is not really a good idea due to the risk of regressions. Docker has basically codified the failure of dynamic linking in the real world.

[ Parent | on HN ]