Live data from Hacker News

Show HN: Smallest Node.js Docker images

github.com

61–66 of 66 posts

Re: Show HN: Smallest Node.js Docker images

#61
post #40

Earlier quoted context omitted.

Unless the exploit makes unreachable code reachable. Security (and privacy) are largely about minimizing surface area.

The "surface" in "attack surface" implies reachability. Your argument doesn't make any sense, how would "the exploit" make an unreachable vulnerability reachable without being able to execute the vulnerable code in the first place? Please don't say "using a different vulnerability that allows us to execute arbitrary code".

> Please don't say "using a different vulnerability that allows us to execute arbitrary code".

Sorry, but I'm going there anyway. Imagine two different exploits. One is a remote code execution exploit and the other is a privilege escalation exploit.

Let's say your application has an exploit an attacker then manages to obtain a reverse shell (imagemagick, xml parsing, etc all have had multiple such exploits over the years). If you're running things correctly, that reverse shell is not privileged. It's the apache user or something. Not a good situation to be in, they can do a lot of damage, but at least some things are safe. They don't have root.

Now the attacker finds that you have X11 installed. It's an old version that was installed by default. It happens to have a root privilege escalation exploit via fonts. Now the attacker has root.

That's what I mean by surface area. Thinking in terms of "have we been compromised" isn't sufficient. Being able to contain the attack is important, and dead code lying around factors into how well you can contain it.

Re: Show HN: Smallest Node.js Docker images

#62
post #48

Earlier quoted context omitted.

`npm` should be included in a final container anyway. Best practices for Docker are to have a separate build and run container. The build container can contain anything you want, but the run container should have only the bare minimum required to execute the artifact produced by the build container.

s/should/shouldn't

Yup, thanks! Typing too quickly. ^^

Re: Show HN: Smallest Node.js Docker images

#63
post #10

The new game of Docker Golf. I once spent like a day trying to debug an issue with pruning dev dependencies from my prod docker image before I stopped to realized how much money I was wasting to save $0.0001 of cloud disk space. It is kinda fun though.

Amdahl’s law in practice

Re: Show HN: Smallest Node.js Docker images

#64
post #45
post #41

Earlier quoted context omitted.

Multi-stage Docker builds are an underutilized pattern. Go ahead, go crazy and add all of the dev dependencies you need to build your package. Once you've done that, take the built package and put it into another container that has only the runtime dependencies. The ideal use-case for this is compiling Go, since you end up with a 1GB build container and a 12MB single-binary production container if you compile with st…

> Just beware when going the FROM SCRATCH route that you get nothing to go with it, you can't shell into the container or run "ps" or "lsof" for debugging because none of those exist. Your image processes run on the host anyway, so just `ps` or `lsof` from the host. I've never had to exec into a Go/scratch container.

> Your image processes run on the host anyway, so just `ps` or `lsof` from the host.

You can’t do this if you don’t have access to and root privileges on the host.

Re: Show HN: Smallest Node.js Docker images

#65
post #56
post #37

Honestly, the size doesn't matter. I was once in the camp of small Docker images, but realized it's simply not worth the tradeoff, since there's only one upside to them, and that upside is fast transfer of images. However, that argument becomes pointless when using a proper CI/CD stack. As a developer, you don't normally upload images yourself, but push changes to GitHub, then Jenkins/Travis/whatever takes over, buil…

What if you need to release a hot fix and your image is 1Gb?

1. I push a hotfix to GitHub. 2. Jenkins (which is on Google Cloud) builds it, and it already has all the Docker steps cached from previous builds, so it's fast. 3. Jenkins pushes the image to Google Cloud repo, which is almost instantaneous 4. Kubernetes (also on Google Cloud) pulls the image and makes a new deployment

No big deal. :)

Re: Show HN: Smallest Node.js Docker images

#66
post #21

Similar one here https://github.com/mhart/alpine-node , base-* versions are static.

That was my first thought too but scratch-node is a bit smaller than alpine-node. I created a ticket to see if alpine-node could get smaller: https://github.com/mhart/alpine-node/issues/133
Post reply on HN