Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Alpine Linux Docker images have NULL for root password

cve.mitre.org

Post reply on HN
Print view View original

51–60 of 203 posts

Re: Alpine Linux Docker images have NULL for root password

#51

Post by sofaofthedamned »

snarfy wrote: post #26
yegle wrote: post #19

Earlier quoted context omitted.

For anyone who want a small image but with glibc, https://github.com/GoogleContainerTools/distroless is a good choice, especially if you are writing in static linked language e.g. Go and Rust.

For statically linked binaries, why wouldn't you use the SCRATCH (0 kb) 'image'?

Depends. Normally I would do with golang apps. But if I need to debug an issue I'll redeploy them with Ubuntu underneath so I can use the debugging tools.

Re: Alpine Linux Docker images have NULL for root password

#52

Post by sofaofthedamned »

yegle wrote: post #39
snarfy wrote: post #26

Earlier quoted context omitted.

For statically linked binaries, why wouldn't you use the SCRATCH (0 kb) 'image'?

For almost any serious job running in production, you might need CA certificates and openssl.

Unless you're behind a load balancer which terminates TLS and the traffic you deal with is purely http.

Re: Alpine Linux Docker images have NULL for root password

#53

Post by blopker »

sosodev wrote: post #12
hnthrow0693 wrote: post #11

I have always been a bit surprised at the popularity of Alpine Linux for docker images. It’s awesome that the images are pretty small, but a wide variety of software has been shown to run noticeably slower on Alpine compared to other distributions, in part due to its usage of musl instead of glibc. I’d think that a few megabytes of disk isn’t as valuable as the extra cpu cycles.

I guess the question is how much slower?

I did an analysis with the official Docker Python image [0] with the --enable-optimizations flag. Although not the point of the results [1], they show a decent speed up when using Debian vs Alpine as well.

[0] https://github.com/docker-library/python/issues/160 [1] https://gist.github.com/blopker/9fff37e67f14143d2757f9f2172c...

Re: Alpine Linux Docker images have NULL for root password

#54

Post by sofaofthedamned »

koolba wrote: post #36
nine_k wrote: post #31

Earlier quoted context omitted.

40mb vs 5mb is like 5x difference. There are also slimmed down images based on Debian or Ubuntu. A number of packages is a bit older versions, though.

You're only playing that 40mb once though. Multiple containers sharing the same parent layers will not require additional storage for the core OS layer.

Exactly. With copy on write and samepage merging it's more important to use the same base image for all your deployments.

Re: Alpine Linux Docker images have NULL for root password

#55

Post by sofaofthedamned »

peterwwillis wrote: post #24
hnthrow0693 wrote: post #11

I have always been a bit surprised at the popularity of Alpine Linux for docker images. It’s awesome that the images are pretty small, but a wide variety of software has been shown to run noticeably slower on Alpine compared to other distributions, in part due to its usage of musl instead of glibc. I’d think that a few megabytes of disk isn’t as valuable as the extra cpu cycles.

It's not a few megabytes, it's a few hundred to a thousand megabytes saved, on average. Multiplied by a thousand containers, and much larger layers on build servers, plus bandwidth, it makes a difference. Worst case for slower processes, things take longer. Worst case for more disk use, things start crashing. For general cases, the former is preferable.

No, it's not. With samepage merging it's nothing, let alone docker only loading the image once.

Re: Alpine Linux Docker images have NULL for root password

#56

Post by Drdrdrq »

adrianmonk wrote: post #30
Drdrdrq wrote: post #13

What exactly is meant by null ? The null / zero character, no password or 4-char string "null"?

It's sloppy writing. They mean it is the empty string in /etc/shadow. Following some links from the CVE, you can find the details (from https://talosintelligence.com/vulnerability_reports/TALOS-20... ): > In builds of the Alpine Docker Image (>=3.3) the /etc/shadow file contains a blank field in place of the encrypted password > ... > The net result of a blank sp_pwdp field is that the system will treat the root user…

Thanks!

Re: Alpine Linux Docker images have NULL for root password

#57

Post by guessmyname »

sofaofthedamned wrote: post #23
hnthrow0693 wrote: post #11

I have always been a bit surprised at the popularity of Alpine Linux for docker images. It’s awesome that the images are pretty small, but a wide variety of software has been shown to run noticeably slower on Alpine compared to other distributions, in part due to its usage of musl instead of glibc. I’d think that a few megabytes of disk isn’t as valuable as the extra cpu cycles.

I've no idea why you wouldn't use Ubuntu which is only around 40mb, has a sane package manager and a standard glibc.

> Ubuntu which is only around 40mb […]

I just downloaded Ubuntu 18.04 and 19.04 and they are not 40MB:

    $ docker image ls | grep ubuntu
    ubuntu  19.04  f723e3b6f1bd   76.4MB
    ubuntu  18.04  d131e0fa2585  102.0MB
    ubuntu  16.04  a51debf7e1eb  116.0MB
How do you get a 40MB Ubuntu Docker image?

---

I followed @sofaofthedamned — https://blog.ubuntu.com/2018/07/09/minimal-ubuntu-released

But I’m still confused, where are they getting 29MB from? Even the compressed files are big:

    Ubuntu Bionic [1]
    - ubuntu-18.04-minimal-cloudimg-amd64-root.tar.xz |  77M
    - ubuntu-18.04-minimal-cloudimg-amd64.img         | 163M
    - ubuntu-18.04-minimal-cloudimg-amd64.squashfs    |  96M
    
    Ubuntu Cosmic [2]
    - ubuntu-18.10-minimal-cloudimg-amd64-root.tar.xz | 210M
    - ubuntu-18.10-minimal-cloudimg-amd64.img         | 295M
    - ubuntu-18.10-minimal-cloudimg-amd64.squashfs    | 229M
    
    Ubuntu Disco [3]
    - ubuntu-19.04-minimal-cloudimg-amd64-root.tar.xz |  69M
    - ubuntu-19.04-minimal-cloudimg-amd64.img         | 155M
    - ubuntu-19.04-minimal-cloudimg-amd64.squashfs    |  89M
[1] http://cloud-images.ubuntu.com/minimal/releases/bionic/relea...

[2] http://cloud-images.ubuntu.com/minimal/releases/cosmic/relea...

[3] http://cloud-images.ubuntu.com/minimal/releases/disco/releas...

Re: Alpine Linux Docker images have NULL for root password

#58

Post by cs02rm0 »

hnthrow0693 wrote: post #11

I have always been a bit surprised at the popularity of Alpine Linux for docker images. It’s awesome that the images are pretty small, but a wide variety of software has been shown to run noticeably slower on Alpine compared to other distributions, in part due to its usage of musl instead of glibc. I’d think that a few megabytes of disk isn’t as valuable as the extra cpu cycles.

Because it's tiny, I tend to default to Alpine and then move away from it where necessary. Rather than worrying about potential CPU performance requirements upfront - premature optimisation and all that.

Re: Alpine Linux Docker images have NULL for root password

#59

Post by souterrain »

hssys wrote: post #34
snarfy wrote: post #26

Earlier quoted context omitted.

For statically linked binaries, why wouldn't you use the SCRATCH (0 kb) 'image'?

You might want at least a shell in the container for debugging?

Adding a shell seems antithetical to deploying production code as a static-linked binary, not to mention an expansion of the attack surface of the container.

Re: Alpine Linux Docker images have NULL for root password

#60

Post by roywiggins »

acct1771 wrote: post #45
sofaofthedamned wrote: post #23

Earlier quoted context omitted.

I've no idea why you wouldn't use Ubuntu which is only around 40mb, has a sane package manager and a standard glibc.

My inability to personally audit systemd would be at the top of the list.

As far as I can tell, the recommended way to run several processes in an Ubuntu container is under supervisord. The default Ubuntu containers don't even include an init system.
Post reply on HN