Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Alpine Linux Docker images have NULL for root password

cve.mitre.org

Post reply on HN
Print view View original

151–160 of 203 posts

Re: Alpine Linux Docker images have NULL for root password

#151

Post by ShinTakuya »

jacques_chester wrote: post #133
icebraining wrote: post #117

Earlier quoted context omitted.

If you reuse the base image, the libc files will be shared anyway.

This is the part most people don't realise. They see Alpine at 5Mb and Ubuntu at 80Mb. They mentally multiply, without realising that each of these will be pulled once for each image built on top of them. For a large cluster it's a wash. You might as well use Ubuntu, Centos -- anything where there are people working fulltime to fix CVEs quickly.

As far as I'm aware you'd have to load that 80mb into memory for each docker container you run so that can add up if you want to run a bunch of containers on a cheap host with 1GB of RAM.

I do agree that people prematurely optimise and mainly incorrectly consider disk space but I think there's a decent use case for tiny images.

Re: Alpine Linux Docker images have NULL for root password

#152

Post by Godel_unicode »

ShinTakuya wrote: post #150
TheDong wrote: post #136

Earlier quoted context omitted.

The first user account is considered an administrator account on most distros by default, so it has sudo privileges. If you can do what you said with a non-wheel/sudo account, that would be a serious vulnerability.

Alternatively, it's possible the distro added the first user account to wheel also. I believe I've seen that in the past.

How do you think that's different than the comment to which you replied?

Re: Alpine Linux Docker images have NULL for root password

#153

Post by sprydevl »

yegle wrote: post #19
hnthrow0693 wrote: post #11

I have always been a bit surprised at the popularity of Alpine Linux for docker images. It’s awesome that the images are pretty small, but a wide variety of software has been shown to run noticeably slower on Alpine compared to other distributions, in part due to its usage of musl instead of glibc. I’d think that a few megabytes of disk isn’t as valuable as the extra cpu cycles.

For anyone who want a small image but with glibc, https://github.com/GoogleContainerTools/distroless is a good choice, especially if you are writing in static linked language e.g. Go and Rust.

If you want small images, why not use a tool like https://github.com/docker-slim/docker-slim Then it doesn’t matter which distro you favor?

Re: Alpine Linux Docker images have NULL for root password

#154

Post by nurettin »

yegle wrote: post #19
hnthrow0693 wrote: post #11

I have always been a bit surprised at the popularity of Alpine Linux for docker images. It’s awesome that the images are pretty small, but a wide variety of software has been shown to run noticeably slower on Alpine compared to other distributions, in part due to its usage of musl instead of glibc. I’d think that a few megabytes of disk isn’t as valuable as the extra cpu cycles.

For anyone who want a small image but with glibc, https://github.com/GoogleContainerTools/distroless is a good choice, especially if you are writing in static linked language e.g. Go and Rust.

I don't quite get it. If you've somehow statically compiled all your dependencies, shouldn't that just run without a container?

Perhaps the point is not to enable program execution, but to make use of the benefits that may come with container orchestration.

Re: Alpine Linux Docker images have NULL for root password

#155

Post by stephenr »

snarfy wrote: post #26
yegle wrote: post #19

Earlier quoted context omitted.

For anyone who want a small image but with glibc, https://github.com/GoogleContainerTools/distroless is a good choice, especially if you are writing in static linked language e.g. Go and Rust.

For statically linked binaries, why wouldn't you use the SCRATCH (0 kb) 'image'?

If your binary is static, why do you need a container at all?

Re: Alpine Linux Docker images have NULL for root password

#156

Post by stephenr »

nine_k wrote: post #31
sofaofthedamned wrote: post #23

Earlier quoted context omitted.

I've no idea why you wouldn't use Ubuntu which is only around 40mb, has a sane package manager and a standard glibc.

40mb vs 5mb is like 5x difference. There are also slimmed down images based on Debian or Ubuntu. A number of packages is a bit older versions, though.

It's sad to me that it wasn't obvious to you 5*5 is not 40, or 40/5 is not 5.

Re: Alpine Linux Docker images have NULL for root password

#157

Post by bayesian_horse »

hnthrow0693 wrote: post #11

I have always been a bit surprised at the popularity of Alpine Linux for docker images. It’s awesome that the images are pretty small, but a wide variety of software has been shown to run noticeably slower on Alpine compared to other distributions, in part due to its usage of musl instead of glibc. I’d think that a few megabytes of disk isn’t as valuable as the extra cpu cycles.

The small size of an image can be an actual issue. Certainly for embedded devices, probably also for clusters.

For me it's mostly a non-issue. But things like redis or nginx work nicely with alpine as a base. And more than likely, whatever I want to containerize has already been containerized for Alpine. If not, getting something to work on Alpine may just not be worth it...

Re: Alpine Linux Docker images have NULL for root password

#158

Post by dastx »

yegle wrote: post #39
snarfy wrote: post #26

Earlier quoted context omitted.

For statically linked binaries, why wouldn't you use the SCRATCH (0 kb) 'image'?

For almost any serious job running in production, you might need CA certificates and openssl.

You can easily use multi stage docker files to copy the certs.

Re: Alpine Linux Docker images have NULL for root password

#159

Post by jlgaddis »

adrianmonk wrote: post #30
Drdrdrq wrote: post #13

What exactly is meant by null ? The null / zero character, no password or 4-char string "null"?

It's sloppy writing. They mean it is the empty string in /etc/shadow. Following some links from the CVE, you can find the details (from https://talosintelligence.com/vulnerability_reports/TALOS-20... ): > In builds of the Alpine Docker Image (>=3.3) the /etc/shadow file contains a blank field in place of the encrypted password > ... > The net result of a blank sp_pwdp field is that the system will treat the root user…

> Arguably, this is crappy design and a better design for /etc/shadow would be to require some kind of explicit, very obvious value like "NO-PASSWORD-REQUIRED".

I think pretty much all Linux distributions use PAM nowadays (although I'm sure there are exceptions).

From pam_unix.so(8):

> The default action of this module is to not permit the user access to a service if their official password is blank.

Unfortunately, many distributions pass the "nullok" option to the pam_unix.so module, overriding this default behavior. Removing any instances of "nullok" from any files in /etc/pam.d/ is highly recommended -- unless you explicitly want this behavior (which could be a reasonable choice, in some specific use cases).

Re: Alpine Linux Docker images have NULL for root password

#160

Post by johncolanduoni »

Nelson69 wrote: post #85
whatshisface wrote: post #28

Earlier quoted context omitted.

Why is musl slower?

I don't want to disparage any project or guess the motivation but there have been some undercurrents of anti-GPL sentiment at times and anti-complexity. Folks have sort of backed it up by posting some links to things that aren't as you might think. GLIBC in particular looks nothing like how you might imagine it. You can look at strlen in the K&R book and it's beautiful, like a textbook: int strlen(char s[]) { int i;…

You'd have to use a pretty esoteric platform to get that version. For most platforms you'll have a handle-rolled assembly version that's dramatically faster than that one (the x86_64 one is here[1]).

[1]: https://github.com/bminor/glibc/blob/master/sysdeps/x86_64/s...

Post reply on HN