Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Alpine Linux Docker images have NULL for root password

cve.mitre.org

Post reply on HN
Print view View original

61–70 of 203 posts

Re: Alpine Linux Docker images have NULL for root password

#61

Post by catern »

yegle wrote: post #37
catern wrote: post #32

Earlier quoted context omitted.

"distroless" is just Debian packages. Their self-description is fairly annoyingly misleading, since they don't mention that they are just using packages from Debian.

Why is that a bad thing? Binaries are binaries, whether you copied from a deb package or completely built from source code (assuming reproducible build, which Debian supports), they are the same.

It's absolutely not a bad thing, indeed I think it's a good thing to use binaries from Debian. I just think the name of the project is strongly misleading. "distroless" is built from the Debian distribution, not something new made from scratch.

Re: Alpine Linux Docker images have NULL for root password

#62

Post by sofaofthedamned »

guessmyname wrote: post #57
sofaofthedamned wrote: post #23

Earlier quoted context omitted.

I've no idea why you wouldn't use Ubuntu which is only around 40mb, has a sane package manager and a standard glibc.

> Ubuntu which is only around 40mb […] I just downloaded Ubuntu 18.04 and 19.04 and they are not 40MB: $ docker image ls | grep ubuntu ubuntu 19.04 f723e3b6f1bd 76.4MB ubuntu 18.04 d131e0fa2585 102.0MB ubuntu 16.04 a51debf7e1eb 116.0MB How do you get a 40MB Ubuntu Docker image? --- I followed @sofaofthedamned — https://blog.ubuntu.com/2018/07/09/minimal-ubuntu-released But I’m still confused, where are they getting 2…

https://blog.ubuntu.com/2018/07/09/minimal-ubuntu-released

Apologies, it's actually 29mb.

Re: Alpine Linux Docker images have NULL for root password

#63

Post by briffle »

sofaofthedamned wrote: post #52
yegle wrote: post #39

Earlier quoted context omitted.

For almost any serious job running in production, you might need CA certificates and openssl.

Unless you're behind a load balancer which terminates TLS and the traffic you deal with is purely http.

sure, as long as you don't connect to ANY outside url's for anything

Re: Alpine Linux Docker images have NULL for root password

#65

Post by alanwreath »

sofaofthedamned wrote: post #52
yegle wrote: post #39

Earlier quoted context omitted.

For almost any serious job running in production, you might need CA certificates and openssl.

Unless you're behind a load balancer which terminates TLS and the traffic you deal with is purely http.

I wonder if this would be important with service mesh and mutual tls...

Re: Alpine Linux Docker images have NULL for root password

#66

Post by sofaofthedamned »

roywiggins wrote: post #60
acct1771 wrote: post #45

Earlier quoted context omitted.

My inability to personally audit systemd would be at the top of the list.

As far as I can tell, the recommended way to run several processes in an Ubuntu container is under supervisord. The default Ubuntu containers don't even include an init system.

Suoervisord is an awful thing to do under a container tbf. Any oom event and it will kill a random process. Not good in a container environment.

Re: Alpine Linux Docker images have NULL for root password

#67

Post by mark242 »

sofaofthedamned wrote: post #52
yegle wrote: post #39

Earlier quoted context omitted.

For almost any serious job running in production, you might need CA certificates and openssl.

Unless you're behind a load balancer which terminates TLS and the traffic you deal with is purely http.

Please don't do this anymore. End-to-end encryption is extremely easy to set up and maintain. P2PE will absolutely lull you into a false sense of security.

Re: Alpine Linux Docker images have NULL for root password

#68

Post by sofaofthedamned »

mark242 wrote: post #67
sofaofthedamned wrote: post #52

Earlier quoted context omitted.

Unless you're behind a load balancer which terminates TLS and the traffic you deal with is purely http.

Please don't do this anymore. End-to-end encryption is extremely easy to set up and maintain. P2PE will absolutely lull you into a false sense of security.

Eh, don't teach my about the systems I run. I'd love to run TLS end to end but in this one? Nah, not worth it.

Re: Alpine Linux Docker images have NULL for root password

#69

Post by jupp0r »

yegle wrote: post #39
snarfy wrote: post #26

Earlier quoted context omitted.

For statically linked binaries, why wouldn't you use the SCRATCH (0 kb) 'image'?

For almost any serious job running in production, you might need CA certificates and openssl.

With static linking your binary would contain openssl.

Re: Alpine Linux Docker images have NULL for root password

#70

Post by shakna »

> Eight days after this vulnerability was initially fixed, a commit was pushed which removed this 'disable root by default' flag from the 'edge' build properties file, reintroducing this issue to subsequent builds.

That... Did not take long. From fix, to regression on a fairly serious security issue (though perhaps not critical, depending how the container infrastructure is set up).

> Unfortunately, later that same year, a commit was pushed to simplify the regression tests. This lead to logic that may have caught this regression being simplified, causing these tests to be incorrectly 'satisfied' if the root password was once again removed.

Testing is hard, and ensuring you meet the requirements but keeping it readable can be harder.

Post reply on HN