Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Awesome Docker Compose Examples

github.com

Post reply on HN
Print view View original

1–10 of 85 posts

Re: Awesome Docker Compose Examples

#2

Post by sneak »

Security note: specifying no version, or a version tag (and not an @-hash) in the docker image name allows DockerHub or the image publisher to replace the code underneath you on container restarts (ie RCE), as they are not cryptographically assured.

Re: Awesome Docker Compose Examples

#3

Post by nandur »

sneak wrote: post #2

Security note: specifying no version, or a version tag (and not an @-hash) in the docker image name allows DockerHub or the image publisher to replace the code underneath you on container restarts (ie RCE), as they are not cryptographically assured.

You would have to down (remove) the container to change the image, if the image is present with the tag if wont get force pulled (singular node scenario), unless you have that image locally, heck this is not that straightforward. I like the idea of using digests though, using both head explodes, explicitly, another head explosion may prevent some headaches.

Re: Awesome Docker Compose Examples

#4

Post by vorpalhex »

sneak wrote: post #2

Security note: specifying no version, or a version tag (and not an @-hash) in the docker image name allows DockerHub or the image publisher to replace the code underneath you on container restarts (ie RCE), as they are not cryptographically assured.

...and you'd have to do that for every single security update for every single service that you run. If you need that level of security that might be appropriate, but most users need security patches more than they need to be concerned with a novel attack that requires DockerHub to intend to RCE them.

Re: Awesome Docker Compose Examples

#5

Post by [deleted] »

nandur wrote: post #3
sneak wrote: post #2

Security note: specifying no version, or a version tag (and not an @-hash) in the docker image name allows DockerHub or the image publisher to replace the code underneath you on container restarts (ie RCE), as they are not cryptographically assured.

You would have to down (remove) the container to change the image, if the image is present with the tag if wont get force pulled (singular node scenario), unless you have that image locally, heck this is not that straightforward. I like the idea of using digests though, using both head explodes , explicitly, another head explosion may prevent some headaches.

[deleted]

Re: Awesome Docker Compose Examples

#6

Post by nickjj »

There's a lot of "tool" selections in that repo.

If anyone is looking for ready to go web app examples aimed at both development and production with Docker Compose, I maintain:

    - https://github.com/nickjj/docker-flask-example
    - https://github.com/nickjj/docker-rails-example
    - https://github.com/nickjj/docker-django-example
    - https://github.com/nickjj/docker-node-example
    - https://github.com/nickjj/docker-phoenix-example
About once a week or so I update them to their latest versions for everything.

The examples use a combination of services for each tech stack such as web + worker + postgres + redis + esbuild + tailwind. The Rails example is set up for Hotwire and runs Action Cable as a dedicated service along with Sidekiq where as the Flask and Django examples use Celery as a worker. You can easily swap things out since the examples are starter projects that you can clone + rename (they all come with a rename script), you're meant to customize them to build your app on top of.

Re: Awesome Docker Compose Examples

#7

Post by decide1000 »

nickjj wrote: post #6

There's a lot of "tool" selections in that repo. If anyone is looking for ready to go web app examples aimed at both development and production with Docker Compose, I maintain: - https://github.com/nickjj/docker-flask-example - https://github.com/nickjj/docker-rails-example - https://github.com/nickjj/docker-django-example - https://github.com/nickjj/docker-node-example - https://github.com/nickjj/docker-phoenix-exam…

Thanks! I will use this.

Re: Awesome Docker Compose Examples

#8

Post by fbdab103 »

nickjj wrote: post #6

There's a lot of "tool" selections in that repo. If anyone is looking for ready to go web app examples aimed at both development and production with Docker Compose, I maintain: - https://github.com/nickjj/docker-flask-example - https://github.com/nickjj/docker-rails-example - https://github.com/nickjj/docker-django-example - https://github.com/nickjj/docker-node-example - https://github.com/nickjj/docker-phoenix-exam…

This looks great. Definitely a few idioms I will have to explore further.

I can use Docker in a basic sense, but it is amazing to me how much black arts still exists for what has become a cornerstone of modern deployment. Lots of conflicting/dated advice about best practices. Unsure which advice is still required/applies to podman, etc.

Re: Awesome Docker Compose Examples

#10

Post by fbdab103 »

vorpalhex wrote: post #4
sneak wrote: post #2

Security note: specifying no version, or a version tag (and not an @-hash) in the docker image name allows DockerHub or the image publisher to replace the code underneath you on container restarts (ie RCE), as they are not cryptographically assured.

...and you'd have to do that for every single security update for every single service that you run. If you need that level of security that might be appropriate, but most users need security patches more than they need to be concerned with a novel attack that requires DockerHub to intend to RCE them.

While the track record of security in the industry is pretty laughable, I do like to delude myself that things are improving.

How many RCEs are discovered per year in baseline Debian/Ubuntu? Seems far more likely that security holes are in the library/application code layered on-top of an image.

Post reply on HN