111–120 of 203 posts
Is this a risk out of the box? $ docker run -it -u guest alpine / $ su su: must be suid to work properly / $ login login: must be suid to work properly / $ find / -perm /4000 -print find: /root: Permission denied find: /proc/tty/driver: Permission denied / $
Earlier quoted context omitted.
Adding a shell seems antithetical to deploying production code as a static-linked binary, not to mention an expansion of the attack surface of the container.
Without a shell, how does one debug if anything goes wrong?
Earlier quoted context omitted.
You might want at least a shell in the container for debugging?
Adding a shell seems antithetical to deploying production code as a static-linked binary, not to mention an expansion of the attack surface of the container.
Earlier quoted context omitted.
sure, as long as you don't connect to ANY outside url's for anything
Which you probably shouldn't be doing for most of your services anyway.
I have always been a bit surprised at the popularity of Alpine Linux for docker images. It’s awesome that the images are pretty small, but a wide variety of software has been shown to run noticeably slower on Alpine compared to other distributions, in part due to its usage of musl instead of glibc. I’d think that a few megabytes of disk isn’t as valuable as the extra cpu cycles.
> I’d think that a few megabytes of disk isn’t as valuable as the extra cpu cycles. Depends on your workload, of course. Some people want to run a huge number of containers and each isn’t compute intensive. Or maybe you don’t use libc at all in your fast path? Lots of cases it makes sense.
Earlier quoted context omitted.
Isn't there an argument that using Alpine instead of something like Ubuntu is premature optimization for space?
It's faster in terms of development time. Faster to install packages and to push to docker repos.
Earlier quoted context omitted.
Benchmarks here: https://www.phoronix.com/scan.php?page=article&item=docker-s... For Python in particular, significantly slower.
The Python test is indeed a large outlier! I wonder how reproducible it is, and what the reason might be.
Earlier quoted context omitted.
Because it's tiny, I tend to default to Alpine and then move away from it where necessary. Rather than worrying about potential CPU performance requirements upfront - premature optimisation and all that.
Isn't there an argument that using Alpine instead of something like Ubuntu is premature optimization for space?