> I can imagine a future world in which package management tools understood containers
Solaris has had this with zones since, IIRC, before Oracle bought Sun.
Oh god no! Zones are cool, but package management on Solaris is pretty bad. It has improved since they built something similar to Apt, but AFAIK it doesn't have the deep understanding of Zones that I'm suggesting is desirable.
Re:Without Systemd
by the_why_of_y on Sunday May 10, 2015 @07:34AM
(#9519603)
On Solaris 10 package management was generally a pain, but there was a "sparse root" kind of zone that shares /usr with the global zone, so these get the updates automatically.
http://solaris.reys.net/zones-in-solaris-10-part-three-spars...
For OpenSolaris derived products with ipkg, the documentation says that "pkg update" in the global zone will update not only the global zone but all non-global zones as well.
This is exactly the same as the virtualization scenario, where you might have hundreds of possibly vulnerable virtual-machines running under the same virtualization platform (which maybe Linux). Or lots of Docker containers, some of which may have vulnerable software.
App-containerization is usually seen as having security benefits, as it promotes isolation.
Yes, package management tools are great. Containers are also great.
I can imagine a future world in which package management tools understood containers, and could choose how to apply updates (or not!) to nested containers.