Re:Ubuntu stops shipping Flatpak by default
by qbasic_forever on Wednesday March 29, 2023 @10:13AM
(#35357578)
It's best practice not to have any shell tools in your app container, including package managers. It bloats the image and can be a security vulnerability if a zero day exploit hits the app. Ideally a container is something like distroless which just has the libc and dependencies you care about and nothing else, not even bash.
[ Parent
| on HN ]
Re:Ubuntu stops shipping Flatpak by default
by Steltek on Wednesday March 29, 2023 @10:19AM
(#35357667)
But where do your dependencies come from? Your compiler? Are you building everything from source after libc?
Re:Ubuntu stops shipping Flatpak by default
by qbasic_forever on Wednesday March 29, 2023 @10:49AM
(#35358091)
If you're shipping modern code like go or rust you have a static build with no real dependencies. If you're shipping a scripting language like python you're probably going to use their base images, and if you're shipping native C/C++ you have to figure out your risk tolerance for trusting a distro to ship good dependencies vs. just building them yourself. It's not hard to build all your deps in a container, and arguably is the best security practice so you have total control and knowledge of their versions.