Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Alpine Linux Docker images have NULL for root password

cve.mitre.org

Post reply on HN
Print view View original

81–90 of 203 posts

Re: Alpine Linux Docker images have NULL for root password

#81

Post by emilfihlman »

cs02rm0 wrote: post #58
hnthrow0693 wrote: post #11

I have always been a bit surprised at the popularity of Alpine Linux for docker images. It’s awesome that the images are pretty small, but a wide variety of software has been shown to run noticeably slower on Alpine compared to other distributions, in part due to its usage of musl instead of glibc. I’d think that a few megabytes of disk isn’t as valuable as the extra cpu cycles.

Because it's tiny, I tend to default to Alpine and then move away from it where necessary. Rather than worrying about potential CPU performance requirements upfront - premature optimisation and all that.

Making it smaller than necessary is a bigger premature optimisation, though. Rather than worrying about potential disk space issues upfront just use glibc and everything works fast and fine.

Re: Alpine Linux Docker images have NULL for root password

#82

Post by mschuster91 »

sofaofthedamned wrote: post #52
yegle wrote: post #39

Earlier quoted context omitted.

For almost any serious job running in production, you might need CA certificates and openssl.

Unless you're behind a load balancer which terminates TLS and the traffic you deal with is purely http.

> and the traffic you deal with is purely http.

Which is a truly rare case as many backend APIs these days are mandatory secured by HTTPS (or LDAPS, SMTPS, IMAPS to name a couple other openssl-based secure protocols).

Re: Alpine Linux Docker images have NULL for root password

#83

Post by outworlder »

koolba wrote: post #36
nine_k wrote: post #31

Earlier quoted context omitted.

40mb vs 5mb is like 5x difference. There are also slimmed down images based on Debian or Ubuntu. A number of packages is a bit older versions, though.

You're only playing that 40mb once though. Multiple containers sharing the same parent layers will not require additional storage for the core OS layer.

Are you guys running everything on a single box?

Do you get all developers to agree on which base image to build all their services from?

I heard about this "oh, it's shared, don't worry" thing before. It started with 40MB. Now that supposedly shared image is half a gig. "Don't worry, it's shared anyway". Expect when it isn't. And when it is, it still slow us down in bringing up new nodes. And guess what, turns out that not everyone is starting from the same point, so there is a multitude of 'shared' images now.

Storage is cheap, but bandwidth may not be. And it still takes time to download. Try to keep your containers as small as possible for as long as possible. Your tech debt may grow slower that way.

Re: Alpine Linux Docker images have NULL for root password

#84

Post by outworlder »

acct1771 wrote: post #45
sofaofthedamned wrote: post #23

Earlier quoted context omitted.

I've no idea why you wouldn't use Ubuntu which is only around 40mb, has a sane package manager and a standard glibc.

My inability to personally audit systemd would be at the top of the list.

Why would anyone run an init system inside a container?

Just run the process. Let whatever is managing your container restart it if the process quits, be it docker or K8s.

Re: Alpine Linux Docker images have NULL for root password

#85

Post by Nelson69 »

whatshisface wrote: post #28
hnthrow0693 wrote: post #11

I have always been a bit surprised at the popularity of Alpine Linux for docker images. It’s awesome that the images are pretty small, but a wide variety of software has been shown to run noticeably slower on Alpine compared to other distributions, in part due to its usage of musl instead of glibc. I’d think that a few megabytes of disk isn’t as valuable as the extra cpu cycles.

Why is musl slower?

I don't want to disparage any project or guess the motivation but there have been some undercurrents of anti-GPL sentiment at times and anti-complexity. Folks have sort of backed it up by posting some links to things that aren't as you might think. GLIBC in particular looks nothing like how you might imagine it. You can look at strlen in the K&R book and it's beautiful, like a textbook: int strlen(char s[]) { int i; i = 0; while( s[i] != '\0') ++i return i; }

then you look at: https://sourceware.org/git/?p=glibc.git;a=blob;f=string/strl...

and your mind will sort of explode for a bit. The difference is the GLIBC version is dramatically faster; take the comments away and most of us wouldn't even know that's strlen. It's more complex, no question, but it's much faster. GLIBC is full of stuff like that. qsort and memcpy are non-obvious to many folks. It's not complexity for no reason, you'd be challenged to build a better qsort than the one in glibc, it's not easy.

Re: Alpine Linux Docker images have NULL for root password

#86

Post by sofaofthedamned »

baq wrote: post #80
sofaofthedamned wrote: post #68

Earlier quoted context omitted.

Eh, don't teach my about the systems I run. I'd love to run TLS end to end but in this one? Nah, not worth it.

I work at $CORP. I don't trust my enterprise IT department with unencrypted traffic for fear of falling victim to stupid traffic shaping or deep packet inspection intrusion prevention going haywire.

Good for you. In my current gig the trade-off is different. I don't work for Google.

Re: Alpine Linux Docker images have NULL for root password

#87

Post by arcticbull »

sofaofthedamned wrote: post #68
mark242 wrote: post #67

Earlier quoted context omitted.

Please don't do this anymore. End-to-end encryption is extremely easy to set up and maintain. P2PE will absolutely lull you into a false sense of security.

Eh, don't teach my about the systems I run. I'd love to run TLS end to end but in this one? Nah, not worth it.

"Don't teach me about ..." -- aren't we all here to learn? Let's keep the tone civil and assume the best.

Re: Alpine Linux Docker images have NULL for root password

#88

Post by LukeShu »

silverwind wrote: post #79
asdfe wrote: post #64

This is not the official Alpine image, it is Glider Labs one.

Yeah, official alpine one looks fine $ docker run -it alpine head -1 /etc/shadow root:!::0:::::

Going through alpine:3.1 to alpine:3.9, then alpine:edge, I see that the following versions have the problem: 3.3, 3.4, 3.5, and 3.8.

Re: Alpine Linux Docker images have NULL for root password

#89

Post by Gladdyu »

sofaofthedamned wrote: post #52
yegle wrote: post #39

Earlier quoted context omitted.

For almost any serious job running in production, you might need CA certificates and openssl.

Unless you're behind a load balancer which terminates TLS and the traffic you deal with is purely http.

https://amp.businessinsider.com/images/5271388a6bb3f7ac4756d...

Re: Alpine Linux Docker images have NULL for root password

#90

Post by hibbelig »

souterrain wrote: post #59
hssys wrote: post #34

Earlier quoted context omitted.

You might want at least a shell in the container for debugging?

Adding a shell seems antithetical to deploying production code as a static-linked binary, not to mention an expansion of the attack surface of the container.

Without a shell, how does one debug if anything goes wrong?
Post reply on HN