Permissive forwarding rule leads to unintentional exposure of containers (2021)

Re:Permissive forwarding rule leads to unintentional exposur... by heywoodlh on Wednesday June 22, 2022 @06:32PM (#31842713)

> but due to all the `apt-get`ing in my dockerfiles, I'd call them anything but reproducable.

Giving this some thought, I agree if you use package managers and base images I don't think it's possible to build images in a perfectly reproducible fashion.

But I would ask: don't image tagging and registries to provide a reproducible output (binary, packages, etc.) make it unnecessary to provide reproducible builds? Why does it matter if the build is perfectly reproducible if the actual output of the image can be reproduced? I.E. if I can run the software from an image built two years ago, does it matter if I can't build the exact Dockerfile from two years ago?

EDIT: fixed some grammar issues

[ Parent | on HN ]

Re:Permissive forwarding rule leads to unintentional exposur... by nightski on Wednesday June 22, 2022 @07:03PM (#31843025)

I don't know, in my opinion then you are just running a container, like running an exe. You really aren't reproducing anything.

[ Parent | on HN ]

Re:Permissive forwarding rule leads to unintentional exposur... by nicoburns on Wednesday June 22, 2022 @08:45PM (#31843796)

A lot of the value of containers seems to be in providing the ease of deployment benefits of a static executable to languages that don’t support compiling to a static executable.

[ Parent | on HN ]

Re:Permissive forwarding rule leads to unintentional exposur... by heywoodlh on Wednesday June 22, 2022 @09:09PM (#31843974)

Isn't that the whole point of a container is to not retain state of anything else within the filesystem other than the desired entrypoint/cmd(s)?

[ Parent | on HN ]