I have always been a bit surprised at the popularity of Alpine Linux for docker images. It’s awesome that the images are pretty small, but a wide variety of software has been shown to run noticeably slower on Alpine compared to other distributions, in part due to its usage of musl instead of glibc. I’d think that a few megabytes of disk isn’t as valuable as the extra cpu cycles.
Alpine Linux Docker images have NULL for root password
11–20 of 203 posts
Re: Alpine Linux Docker images have NULL for root password
#12I have always been a bit surprised at the popularity of Alpine Linux for docker images. It’s awesome that the images are pretty small, but a wide variety of software has been shown to run noticeably slower on Alpine compared to other distributions, in part due to its usage of musl instead of glibc. I’d think that a few megabytes of disk isn’t as valuable as the extra cpu cycles.
I guess the question is how much slower?
Re: Alpine Linux Docker images have NULL for root password
#13What exactly is meant by null? The null / zero character, no password or 4-char string "null"?
Re: Alpine Linux Docker images have NULL for root password
#14> Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the `root` user. This vulnerability appears to be the result of a regression introduced in December of 2015.
Emphasis mine.
If this tells us something is that how inconsequential is that.
A lot of software already runs with uid 0 inside a container. So, if you got an RCE in that software, you've got a container root anyway. Containers normally do not expose anything else but the target daemon to the network, so cracking in through a non-privileged daemon is unlikely.
Container's root does not map to host's root, so any intrusion is most likely limited to the container if detected soon enough (though it's far from being bullet-proof).
Re: Alpine Linux Docker images have NULL for root password
#15I have always been a bit surprised at the popularity of Alpine Linux for docker images. It’s awesome that the images are pretty small, but a wide variety of software has been shown to run noticeably slower on Alpine compared to other distributions, in part due to its usage of musl instead of glibc. I’d think that a few megabytes of disk isn’t as valuable as the extra cpu cycles.
> I’d think that a few megabytes of disk isn’t as valuable as the extra cpu cycles.
Depends on your workload, of course. Some people want to run a huge number of containers and each isn’t compute intensive.
Or maybe you don’t use libc at all in your fast path?
Lots of cases it makes sense.
Re: Alpine Linux Docker images have NULL for root password
#16I have always been a bit surprised at the popularity of Alpine Linux for docker images. It’s awesome that the images are pretty small, but a wide variety of software has been shown to run noticeably slower on Alpine compared to other distributions, in part due to its usage of musl instead of glibc. I’d think that a few megabytes of disk isn’t as valuable as the extra cpu cycles.
I guess the question is how much slower?
Benchmarks here: https://www.phoronix.com/scan.php?page=article&item=docker-s...
For Python in particular, significantly slower.
Re: Alpine Linux Docker images have NULL for root password
#17I highly recommend using user namespaces for Docker. [1]
It means the host is protected from privilege escalation in the container.
Re: Alpine Linux Docker images have NULL for root password
#18I have always been a bit surprised at the popularity of Alpine Linux for docker images. It’s awesome that the images are pretty small, but a wide variety of software has been shown to run noticeably slower on Alpine compared to other distributions, in part due to its usage of musl instead of glibc. I’d think that a few megabytes of disk isn’t as valuable as the extra cpu cycles.
If your software is heavily CPU-bound, and the difference matters for you, you can likely find or build a highly optimized image for your particular number-crunching task.
If your software is I/O-bound, and is written in a language like Python or Ruby, and sits idle waiting for requests for significant time anyway, CPU performance is likely not key for you. This also represents the majority case, AFAICT.
Re: Alpine Linux Docker images have NULL for root password
#19I have always been a bit surprised at the popularity of Alpine Linux for docker images. It’s awesome that the images are pretty small, but a wide variety of software has been shown to run noticeably slower on Alpine compared to other distributions, in part due to its usage of musl instead of glibc. I’d think that a few megabytes of disk isn’t as valuable as the extra cpu cycles.
For anyone who want a small image but with glibc, https://github.com/GoogleContainerTools/distroless is a good choice, especially if you are writing in static linked language e.g. Go and Rust.
Re: Alpine Linux Docker images have NULL for root password
#20I have always been a bit surprised at the popularity of Alpine Linux for docker images. It’s awesome that the images are pretty small, but a wide variety of software has been shown to run noticeably slower on Alpine compared to other distributions, in part due to its usage of musl instead of glibc. I’d think that a few megabytes of disk isn’t as valuable as the extra cpu cycles.
What is the better and safer alternative for cases where some extra megabytes are ok?