51% of 4M Docker images have critical vulnerabilities

Re:51% of 4M Docker images have critical vulnerabilities by marcosdumay on Thursday December 17, 2020 @10:27AM (#25456384)

Hum... Docker automatically adds an entire OS as static dependency to anything. How does that goes with "not using too many dependencies" rule?

Also, good luck doing static analysis on binary tools.

There's an entire area of work people call "ops" that specializes on managing that dependency. But they can only do that if it's dynamic and loosely coupled.

[ Parent | on HN ]

Re:51% of 4M Docker images have critical vulnerabilities by oblio on Thursday December 17, 2020 @10:38AM (#25456506)

Ummm...

You make your own images, if you really care. You involve your "ops" people in that.

They manage the base images that are then used by your dev team. They're responsible for updating the base images.

Your dev team provides a CI/CD pipeline which the ops team can use to check that security updates don't break functionality.

It's not rocket science.

[ Parent | on HN ]

Re:51% of 4M Docker images have critical vulnerabilities by cle on Thursday December 17, 2020 @12:13PM (#25457573)

Docker doesn’t add anything as a dependency, you do. Use “FROM scratch” if you want to run a process with nothing but the Linux kernel. You won’t even get libc.

[ Parent | on HN ]