Everybody loves containers until the deepest component of every running system has a security issue
0 Boosts
0 Likes
@r0se Which is why I don't do docker shit for containers, just regular distros in them.
@lanodan even distro based containers still have the issue of needing to fully rebuild to have fixed ca-certificates
@r0se I mean incus or bwrap (my workflow dating back to illumos zones), so it's just running something like apk upgrade and that's it.
No OCI, I take those as the mothers of all blobs.
static emulation (dynamically linked but you ship all the libraries) + C embed emulation (you ship the runtime files in the bundle)
if you treat them as though they are exactly this it’s fine, because that’s literally what they are
at which point you should also prefer statically linked embedded binaries because you have a whole lot less attack surface in total, but it’s not always an option
this approach is why quadlet is actually a pretty good concept if you’re gonna use containers anyway, and why I wrote squintlet (quadlet if you squint, compatible with any daemontools-likes)