11–20 of 33 posts
Earlier quoted context omitted.
Hard pass... In general, a public security policy is pointless. It is the one layer you want people to trip over when breaking a system. =3
Why do you say so?
Nuisance users don't publish CVE, and a zero trust model shows you something important. =3
This is great. I have been talking to quite some vendors in the space. I have looked in docker hardened images too. They have made it free too. I think the problem in general is hardened image market is keeping up with CVEs and making sure the catalog is vast so that it covers all the images and nuances. Responding and patchibg CVEs with an SLA is the KPI of the vendors. As much as I would like cheer for you, doing i…
Thanks for looking into this! I agree with you and hence I'm also relying on Wolfi packages, which will ensure they are updated as soon as upstream is available so I'm piggy backing on that. Github Actions run daily/weekly based on the cadence and once the pipeline is setup do not require a significant effort imo. And I want it to be community driven so we can add images as and when people want it and build it accord…
Earlier quoted context omitted.
Thanks for looking into this! I agree with you and hence I'm also relying on Wolfi packages, which will ensure they are updated as soon as upstream is available so I'm piggy backing on that. Github Actions run daily/weekly based on the cadence and once the pipeline is setup do not require a significant effort imo. And I want it to be community driven so we can add images as and when people want it and build it accord…
Isn't this mostly the same thing that Chainguard already provides themselves? E.g. the "Free" images on their page [0] have a big overlap with the toolchains from your repo. [0]: https://images.chainguard.dev
I don't understand why one would go halfway and leave packages which are unneeded for services. The only executable in a hardened container image should be your application.
Why does this not use chisel? I assume you at least drop the bin dir? Although the presence of ncurses is super weird I don't understand why one would go halfway and leave packages which are unneeded for services. The only executable in a hardened container image should be your application.
Earlier quoted context omitted.
Isn't this mostly the same thing that Chainguard already provides themselves? E.g. the "Free" images on their page [0] have a big overlap with the toolchains from your repo. [0]: https://images.chainguard.dev
Some images do overlap yes, but they are some of the most popular ones used and I wanted to demonstrate how they can be build as well. Half of them are only available through paid versions. I will be adding new images on regular basis, based on usage and impact.
I was looking into how to create more secure container image and this looks like a great resource! :)
Dumb question but how would these work in practice? I use kamal to deploy containerized applications. Would I on a regular basis update the versions of the underlying images to match the latest hardened container and then redeploy? I assume this is automatable?
Earlier quoted context omitted.
Isn't this mostly the same thing that Chainguard already provides themselves? E.g. the "Free" images on their page [0] have a big overlap with the toolchains from your repo. [0]: https://images.chainguard.dev
Some images do overlap yes, but they are some of the most popular ones used and I wanted to demonstrate how they can be build as well. Half of them are only available through paid versions. I will be adding new images on regular basis, based on usage and impact.
This looks really good. Good luck for your project!
Also a quick question but when you mention Minimal being well.. Minimal? How much more minimal would it be compared to say alpine?
Also maybe I should stop saying so many times minimal in this comment haha!
Earlier quoted context omitted.
Why do you say so?
Best to look at security policy using ecological predator-prey models. If you don't, than you fall victim to the assumption a "puzzle" you can't break is unbreakable in general. Nuisance users don't publish CVE, and a zero trust model shows you something important. =3
I am curious to ask now but why do you end every message with =3 & when did you start with this trend, really curious now xD
Earlier quoted context omitted.
Best to look at security policy using ecological predator-prey models. If you don't, than you fall victim to the assumption a "puzzle" you can't break is unbreakable in general. Nuisance users don't publish CVE, and a zero trust model shows you something important. =3
Joel a little offtopic but looks like we have bumped into each other 3 times now (I remember you from VM comment and then today on a different comment and now this) I am curious to ask now but why do you end every message with =3 & when did you start with this trend, really curious now xD