21–30 of 89 posts
While I do appreciate the great work than Dan and team do, I feel like posting this headline, at this time, is click-baiting and playing off the recent Red Hat shake up to try and grab attention.
While I do appreciate the great work than Dan and team do, I feel like posting this headline, at this time, is click-baiting and playing off the recent Red Hat shake up to try and grab attention.
Earlier quoted context omitted.
Think of a circle with a fine split in it. At one end there's using a distro. You go around the circle to distroless, and on the other end of the circle, close to using a distro, but not using a distro, is un-distro. Paraphrased in jest from https://www.youtube.com/watch?v=_OEO79B-CZ4 Seems they use it to highlight it's not just distroless but also kernel-less[1]. [1]: https://www.chainguard.dev/unchained/introducing…
The last section in the link helped, but I have to say, the circle analogy made very little sense to me. Thank you for clarifying nonetheless.
Yeah, was just a silly connection I made to the sample used in the track[1]. From a documentary on LSD[2].
[1]: https://www.psydb.net/release/hallucinogen-the-lone-deranger...
Whats wrong with current distros vuln assesment and security reporting to have another one?
Distroless or not, maintainers are required… but for me running docker pull debian still does the job. Whats wrong with current distros vuln assesment and security reporting to have another one?
If you "apt-get install nodejs", you can only have Node.js v18, in the very very recently released Debian bookworm. If your devs need Node.js v20, or even v22 which will both be LTS releases during the bookworm release cycle, you're out of luck.
You can go install those outside of the Debian package manager, but then you're on your own for vuln assessment and security fixes. Worse - many scanners don't actually even "see" packages that are installed outside of package managers, so you may not know that these exist or are installed.
We designed Wolfi to be more flexible around package versions. This is a very very hard problem to solve in general, but since we're focused on immutable containers, we can skip a lot of the complexity around conflicts, upgrade/downgrade scenarios, and cross-version compatibility.
Distroless or not, maintainers are required… but for me running docker pull debian still does the job. Whats wrong with current distros vuln assesment and security reporting to have another one?
Debian does a great job! But here's one example where their packaging system makes container workloads hard. Debian, like many other distros has a strict "one version of every package" rule, meaning that Debian only ships one version of common things like programming languages or webservers. If you "apt-get install nodejs", you can only have Node.js v18, in the very very recently released Debian bookworm. If your dev…
Earlier quoted context omitted.
Debian does a great job! But here's one example where their packaging system makes container workloads hard. Debian, like many other distros has a strict "one version of every package" rule, meaning that Debian only ships one version of common things like programming languages or webservers. If you "apt-get install nodejs", you can only have Node.js v18, in the very very recently released Debian bookworm. If your dev…
That's cool, but aren't containers considered to be a workaround for exactly that problem?
It's going to be hard to scale, but we're going to at least try! We have a lot of ideas on how to make this work that I'm excited to try out.
https://www.chainguard.dev/unchained/minimal-container-image...
> Wolfi is a Linux undistro designed from the ground up to support newer computing paradigms such as containers. Although Wolfi has a few similar design principles as Alpine (such as using apk), it is a different distribution that is focused on supply chain security. Unlike Alpine, Wolfi does not currently build its own Linux kernel, instead relying on the host environment (e.g. a container runtime) to provide one.
Is it possible to expand on this more? Why should I, a technical expert, use this over an already established distribution (Alpine)? What are good talking points I can bring to management / architects that would sell them on a switch?
Can you expand on what “supply chain security” actually means?
We use Alpine Linux in all our docker builds for AWS ECS / Fargate. I noticed the FAQ says this: > Wolfi is a Linux undistro designed from the ground up to support newer computing paradigms such as containers. Although Wolfi has a few similar design principles as Alpine (such as using apk), it is a different distribution that is focused on supply chain security. Unlike Alpine, Wolfi does not currently build its own L…
We're also more flexible on packaging extra software in Wolfi than other distros are, which has an effect on your overall supply chain security posture. We're aiming to package the entire Cloud Native landscape (to start!), so you can simply "apk add" anything you need, without having to drop back to "curl | bash" in your Dockerfile.
By making it easier for devs to get the software they need "the right way", they'll have a reduced need to work around the already existing secure distribution mechanisms built into their distros.
If you're already on Alpine and like it, that's great! If there are some packages you can't find in Alpine, or musl vs. glibc ever causes you issues, or you need SBOMs for some reason, give Wolfi a try!