Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wolfi: A community Linux OS designed for the container and cloud-native era

github.com

Post reply on HN
Print view View original

41–50 of 89 posts

Re: Wolfi: A community Linux OS designed for the container and cloud-native era

#41

Post by dlor »

Gasp0de wrote: post #35
dlor wrote: post #25

Earlier quoted context omitted.

Debian does a great job! But here's one example where their packaging system makes container workloads hard. Debian, like many other distros has a strict "one version of every package" rule, meaning that Debian only ships one version of common things like programming languages or webservers. If you "apt-get install nodejs", you can only have Node.js v18, in the very very recently released Debian bookworm. If your dev…

If I need node.js 20 I will just use the node:20-bookworm image.

And the fun part there is that this image is effectively a workaround - node.js 20 is installed via curl | bash. That means CVE scanners and SCA tools can miss node itself in that image.

As silly as it sounds, try running "snyk container test --print-deps" on that image, and look around for Node.

This approach works fine, but means that you might not be able to rely on most container security scanners to let you know when there's an issue.

Re: Wolfi: A community Linux OS designed for the container and cloud-native era

#42

Post by dlor »

Gasp0de wrote: post #38
dlor wrote: post #27

Earlier quoted context omitted.

Yep, but workarounds come with a cost. We're trying to package basically everything, so you don't need to pick between "up to date software" and "software from a trusted distro". It's going to be hard to scale, but we're going to at least try! We have a lot of ideas on how to make this work that I'm excited to try out.

So you want to provide all the up to date software, but as battle tested as the software included in the debian repos, with a few people?

Roughly yes! I think we have a few advantages - mainly that we're focused on container workloads - that simplify the problem. But otherwise, yes!

I'm betting that with enough automation we can get there :)

Re: Wolfi: A community Linux OS designed for the container and cloud-native era

#43

Post by killjoywashere »

dlor wrote: post #37
cookiengineer wrote: post #34

Earlier quoted context omitted.

Do you provide an OVAL feed? Alpine is out of the picture for us because the guy that works on their security tracker just doesn't care, and responds half a year after filing an issue. The tracker itself is broken for over a year and the response was to basically rebuild our own package index and host our own security tracker. So I would not say that Alpine has security as a high priority, even though in theory there…

Thanks for the pointer! We update the JSON feed now but should be able to generate an OVAL feed too.

OVAL: https://oval.mitre.org/

Re: Wolfi: A community Linux OS designed for the container and cloud-native era

#44

Post by k1rby »

amouat wrote: post #17
iamstan23 wrote: post #10

Not sure an OS created to meet the specific need of VC funded startup, created exclusively by employees of that company should be called a "community Linux". It's almost the opposite of that in fact.

You're welcome to join the regular community meeting: https://github.com/wolfi-dev/community We do fully intend for wolfi to be a community project, but it will take some time. We do say on the home page: >What are the plans for long-term Wolfi governance? We intend for Wolfi to be a community-driven project, which means over time it will have multi-vendor governance and maintainers. For now we're focused on building…

++the next call is July 5th at 12 pm EST. Come with questions! Here is the direct link to the public calendar :o)

https://www.google.com/calendar/event?eid=aWpydnZxc2VhaHBlMz...

Re: Wolfi: A community Linux OS designed for the container and cloud-native era

#46

Post by kristianpaul »

dlor wrote: post #27
solarkraft wrote: post #26

Earlier quoted context omitted.

That's cool, but aren't containers considered to be a workaround for exactly that problem?

Yep, but workarounds come with a cost. We're trying to package basically everything, so you don't need to pick between "up to date software" and "software from a trusted distro". It's going to be hard to scale, but we're going to at least try! We have a lot of ideas on how to make this work that I'm excited to try out.

We can always come back to the discussion of statically linked vs dynamically. If your build system is strong an can adapt to these changes thats another option.

Re: Wolfi: A community Linux OS designed for the container and cloud-native era

#47

Post by [deleted] »

SamuelAdams wrote: post #29

We use Alpine Linux in all our docker builds for AWS ECS / Fargate. I noticed the FAQ says this: > Wolfi is a Linux undistro designed from the ground up to support newer computing paradigms such as containers. Although Wolfi has a few similar design principles as Alpine (such as using apk), it is a different distribution that is focused on supply chain security. Unlike Alpine, Wolfi does not currently build its own L…

[deleted]

Re: Wolfi: A community Linux OS designed for the container and cloud-native era

#48

Post by kristianpaul »

dlor wrote: post #41
Gasp0de wrote: post #35

Earlier quoted context omitted.

If I need node.js 20 I will just use the node:20-bookworm image.

And the fun part there is that this image is effectively a workaround - node.js 20 is installed via curl | bash. That means CVE scanners and SCA tools can miss node itself in that image. As silly as it sounds, try running "snyk container test --print-deps" on that image, and look around for Node. This approach works fine, but means that you might not be able to rely on most container security scanners to let you know…

You can scan the file system, probably thats what AWS ECR does?

At the end of they you need to keep an eye on file integrity, because of rootkits, config integrity…

Yeah there are many wats to approach to this… with its corresponding costs of course

Re: Wolfi: A community Linux OS designed for the container and cloud-native era

#49

Post by xnyanta »

dlor wrote: post #41
Gasp0de wrote: post #35

Earlier quoted context omitted.

If I need node.js 20 I will just use the node:20-bookworm image.

And the fun part there is that this image is effectively a workaround - node.js 20 is installed via curl | bash. That means CVE scanners and SCA tools can miss node itself in that image. As silly as it sounds, try running "snyk container test --print-deps" on that image, and look around for Node. This approach works fine, but means that you might not be able to rely on most container security scanners to let you know…

Sounds to me like CVE scanners aren't doing a great job if they can't pick up a nodejs installation from the official nodejs image distribution. Just looking at package manager metadata effectively won't give you the full picture.

Re: Wolfi: A community Linux OS designed for the container and cloud-native era

#50

Post by dlor »

jmakov wrote: post #45

Why would I use that instead Clear Linux?

Wolfi is for running inside the container instead of on a VM or bare metal host. They're complementary - you'd run something like Clear Linux to boot up into a container host, then run this inside the containers.
Post reply on HN