Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Alpine Linux Docker images have NULL for root password

cve.mitre.org

Post reply on HN
Print view View original

41–50 of 203 posts

Re: Alpine Linux Docker images have NULL for root password

#41

Post by wmf »

josteink wrote: post #33
sofaofthedamned wrote: post #23

Earlier quoted context omitted.

I've no idea why you wouldn't use Ubuntu which is only around 40mb, has a sane package manager and a standard glibc.

I’ll try not to be opinionated, but starting an app inside Ubuntu typically has 50+ processes. In most cases with Alpine-based containers, the only process is the one that you actually want to run. Add to that that modern Ubuntu uses systemd which greatly exhausts the system’s inotify limits, so running 3-4 Ubuntu-containers can easily kill a systems ability to use inotify at all, across containers and the host syste…

I don't think your LXC experience applies to Docker. Most Ubuntu-based Docker containers are not running full init.

Re: Alpine Linux Docker images have NULL for root password

#42

Post by makapuf »

nine_k wrote: post #31
sofaofthedamned wrote: post #23

Earlier quoted context omitted.

I've no idea why you wouldn't use Ubuntu which is only around 40mb, has a sane package manager and a standard glibc.

40mb vs 5mb is like 5x difference. There are also slimmed down images based on Debian or Ubuntu. A number of packages is a bit older versions, though.

Technically it's closer to 8. Which is quite a bit. That said even. If it's relatively very different, absolutely speaking its 40mb which is very little even if you have to transfer it up.

Re: Alpine Linux Docker images have NULL for root password

#43

Post by mixmastamyk »

josteink wrote: post #33
sofaofthedamned wrote: post #23

Earlier quoted context omitted.

I've no idea why you wouldn't use Ubuntu which is only around 40mb, has a sane package manager and a standard glibc.

I’ll try not to be opinionated, but starting an app inside Ubuntu typically has 50+ processes. In most cases with Alpine-based containers, the only process is the one that you actually want to run. Add to that that modern Ubuntu uses systemd which greatly exhausts the system’s inotify limits, so running 3-4 Ubuntu-containers can easily kill a systems ability to use inotify at all, across containers and the host syste…

Their minimal images are well, minimal. Maybe not as minimal as Alpine, but not heavy either.

Re: Alpine Linux Docker images have NULL for root password

#44

Post by bogomipz »

hnthrow0693 wrote: post #11

I have always been a bit surprised at the popularity of Alpine Linux for docker images. It’s awesome that the images are pretty small, but a wide variety of software has been shown to run noticeably slower on Alpine compared to other distributions, in part due to its usage of musl instead of glibc. I’d think that a few megabytes of disk isn’t as valuable as the extra cpu cycles.

>"It’s awesome that the images are pretty small, but a wide variety of software has been shown to run noticeably slower on Alpine compared to other distributions, in part due to its usage of musl instead of glibc"

Might you have any citation(s) for this? I have not heard this before. Could you elaborate on what some the "wide variety of software" is? Thanks.

Re: Alpine Linux Docker images have NULL for root password

#45

Post by acct1771 »

sofaofthedamned wrote: post #23
hnthrow0693 wrote: post #11

I have always been a bit surprised at the popularity of Alpine Linux for docker images. It’s awesome that the images are pretty small, but a wide variety of software has been shown to run noticeably slower on Alpine compared to other distributions, in part due to its usage of musl instead of glibc. I’d think that a few megabytes of disk isn’t as valuable as the extra cpu cycles.

I've no idea why you wouldn't use Ubuntu which is only around 40mb, has a sane package manager and a standard glibc.

My inability to personally audit systemd would be at the top of the list.

Re: Alpine Linux Docker images have NULL for root password

#46

Post by saagarjha »

whatshisface wrote: post #28
hnthrow0693 wrote: post #11

I have always been a bit surprised at the popularity of Alpine Linux for docker images. It’s awesome that the images are pretty small, but a wide variety of software has been shown to run noticeably slower on Alpine compared to other distributions, in part due to its usage of musl instead of glibc. I’d think that a few megabytes of disk isn’t as valuable as the extra cpu cycles.

Why is musl slower?

It's much simpler and more oriented towards POSIX compatibility than performance.

Re: Alpine Linux Docker images have NULL for root password

#47

Post by zbentley »

acct1771 wrote: post #45
sofaofthedamned wrote: post #23

Earlier quoted context omitted.

I've no idea why you wouldn't use Ubuntu which is only around 40mb, has a sane package manager and a standard glibc.

My inability to personally audit systemd would be at the top of the list.

Ubuntu Docker images do not run systemd by default or in most configurations. In many images it is removed entirely.

Re: Alpine Linux Docker images have NULL for root password

#48

Post by silluk »

acct1771 wrote: post #45
sofaofthedamned wrote: post #23

Earlier quoted context omitted.

I've no idea why you wouldn't use Ubuntu which is only around 40mb, has a sane package manager and a standard glibc.

My inability to personally audit systemd would be at the top of the list.

I wouldn't be too concerned about that in a container since you're probably not running systemd in that context.

Re: Alpine Linux Docker images have NULL for root password

#49

Post by cpuguy83 »

nine_k wrote: post #14

> Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the `root` user. This vulnerability appears to be the result of a regression introduced in December of 2015 . Emphasis mine. If this tells us something is that how inconsequential is that. A lot of software already runs with uid 0 inside a container. So, if you got an RCE in that software, you've got a container root anyway…

Container's root most certainly does map to host root unless you've enabled user namespaces (which is painful).

However, root in a container does have many privileges dropped and seccomp policies applied (assuming you haven't turned seccomp off via k8s).

Re: Alpine Linux Docker images have NULL for root password

#50

Post by Xylakant »

acct1771 wrote: post #45
sofaofthedamned wrote: post #23

Earlier quoted context omitted.

I've no idea why you wouldn't use Ubuntu which is only around 40mb, has a sane package manager and a standard glibc.

My inability to personally audit systemd would be at the top of the list.

given that containers usually do not include any init system at all that’s not a good reason to pick a side.
Post reply on HN