Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wolfi: A community Linux OS designed for the container and cloud-native era

github.com

Post reply on HN
Print view View original

71–80 of 89 posts

Re: Wolfi: A community Linux OS designed for the container and cloud-native era

#71

Post by schemescape »

bit_flipper wrote: post #70
schemescape wrote: post #65

Earlier quoted context omitted.

Can anyone help me understand musl libc and DNS issues? Note that I’m most interested in this “DNS over TCP” issue, since the other case I’ve heard of is for custom DNS setup—not for resolving host names in a default configuration . My reading indicates that DNS resolution simply might not work in certain cases. This seems like a huge problem, yet Alpine Linux is widely deployed and I think Zig uses musl libc as well…

If you use Musl 1.2.4+ (or Alpine 3.18+), there are no longer the same DNS fallback issues: https://www.openwall.com/lists/musl/2023/05/02/1 To summarize the issue: DNS is done optimistically over UDP because it's faster, but this doesn't work when DNS responses are large because of the design of UDP. TCP should be used as a fallback mechanism when responses are large. This is uncommon normally, but increasingly DNS…

I’d found bits and pieces of this, but I didn’t have all the context. Thank you for summarizing!

Re: Wolfi: A community Linux OS designed for the container and cloud-native era

#72

Post by amouat »

xnyanta wrote: post #63
amouat wrote: post #60

Earlier quoted context omitted.

I think it's more subpackages such as -dev, -lib and -doc variants. These are defined as part of the parent package but count as distinct packages.

Even so, I did a quick search on repology and Nix derivations with multiple outputs (the nix lingo analogous to the subpackages you mentioned) are counted as a single package. For example, bash has 5 outputs but only counts for 1 package in the 85k figure, so I think comparing 900 packages to 85k is a valid comparison. Anyway, this is all besides the point I was trying to make which is that I don't see why I should u…

We needed Wolfi to be able to create minimal (distroless if you like) container images based on glibc with 0 vulnerabilities. Turns out a lot of other people are interested in Wolfi for various reasons, and we're more than happy to work with them.

You definitely don't need to use Wolfi! But I would say, if you run containers you might want to check out Chainguard Images: https://github.com/chainguard-images/images

Re: Wolfi: A community Linux OS designed for the container and cloud-native era

#73

Post by mdaniel »

p4bl0 wrote: post #57

Before reading the linked page, I thought this was about a Linux distribution optimized to run both local but containerized applications and remote/cloud web applications, kind of a ChromeOS like distribution with the same focus on simplicity and security, but with an addition local execution approach based on containers, and less tied to Google. So, this is not at all this, but now I wonder if a distribution like th…

To add to the other excellent answers, I would recommend adding Bottlerocket to your reading list: https://github.com/bottlerocket-os/bottlerocket#readme

I'm also aware of (but haven't used) https://github.com/siderolabs/talos#readme

I just realized your question may have implied a desktop os, whereas Bottlerocket, Flatcar, and likely the others in this specific thread are server-side. I don't have much experience with trying to solve that problem on the desktop except for the horror-show that is snap

Re: Wolfi: A community Linux OS designed for the container and cloud-native era

#74

Post by panekj »

cookiengineer wrote: post #34
dlor wrote: post #30

Earlier quoted context omitted.

In this case, supply chain security mostly means compliance. Alpine and other distros already do a great job at most aspects of supply chain security, but we make package/image signatures and SBOMs very easy to get in Wolfi. We're also more flexible on packaging extra software in Wolfi than other distros are, which has an effect on your overall supply chain security posture. We're aiming to package the entire Cloud N…

Do you provide an OVAL feed? Alpine is out of the picture for us because the guy that works on their security tracker just doesn't care, and responds half a year after filing an issue. The tracker itself is broken for over a year and the response was to basically rebuild our own package index and host our own security tracker. So I would not say that Alpine has security as a high priority, even though in theory there…

Probably because "the guy" is not a guy, but who cares, it's easier to just be salty on HN and spread lies about the project.

Re: Wolfi: A community Linux OS designed for the container and cloud-native era

#75

Post by gunapologist99 »

xnyanta wrote: post #52

I've attended a local CNCF meetup where the chainguard folks presented Wolfi and their related tools to create container images and SBOMs. I was already skeptical of the product, having heard of it before. Unfortunately, attending that talk confirmed to me that they've just re-invented a severely limited version of Nix powered by yaml files that can output SBOMs in a standard format. Their software repository only ha…

> endless DNS resolution issues

should now be resolved (UDP fallback to TCP), even though it's arguable that this is actually rooted in issues elsewhere in the stack.

Re: Wolfi: A community Linux OS designed for the container and cloud-native era

#76

Post by jzelinskie »

xnyanta wrote: post #52

I've attended a local CNCF meetup where the chainguard folks presented Wolfi and their related tools to create container images and SBOMs. I was already skeptical of the product, having heard of it before. Unfortunately, attending that talk confirmed to me that they've just re-invented a severely limited version of Nix powered by yaml files that can output SBOMs in a standard format. Their software repository only ha…

I would love to see non-trivial examples of using the nix toolchain to build images with multiple OS, architectures, SBOMs. As someone unfamiliar with the nix ecosystem, it seems like a tough ask for contributors to require nix knowledge rather than just changing out my existing base image.

Re: Wolfi: A community Linux OS designed for the container and cloud-native era

#77

Post by xnyanta »

jzelinskie wrote: post #76
xnyanta wrote: post #52

I've attended a local CNCF meetup where the chainguard folks presented Wolfi and their related tools to create container images and SBOMs. I was already skeptical of the product, having heard of it before. Unfortunately, attending that talk confirmed to me that they've just re-invented a severely limited version of Nix powered by yaml files that can output SBOMs in a standard format. Their software repository only ha…

I would love to see non-trivial examples of using the nix toolchain to build images with multiple OS, architectures, SBOMs. As someone unfamiliar with the nix ecosystem, it seems like a tough ask for contributors to require nix knowledge rather than just changing out my existing base image.

I'm not sure what you mean by "non-trivial" but here's a simple discord bot I wrote in python, that I distribute as an OCI image and that is built with Nix for both x86_64 and aarch64 linux via GitHub actions: https://github.com/starcraft66/attention-attention

There is no SBOM because I didn't bother publishing one but the way Nix builds derivations, you basically get the SBOM for free. You could use a tool like sbomnix[1] to trivially generate an SPDX-format SBOM from the nix derivation that builds the container image.

Edit: Since you mention swapping out base images, I think there is a misconception about how building images with Nix works. There is no such thing as a "Base" image, nix builds images from the Dockerfile equivalent of "scratch". You would ditch the Dockerfile completely and use only Nix to build the image.

1: https://github.com/tiiuae/sbomnix

Re: Wolfi: A community Linux OS designed for the container and cloud-native era

#78

Post by tptacek »

blueflow wrote: post #66
xnyanta wrote: post #52

I've attended a local CNCF meetup where the chainguard folks presented Wolfi and their related tools to create container images and SBOMs. I was already skeptical of the product, having heard of it before. Unfortunately, attending that talk confirmed to me that they've just re-invented a severely limited version of Nix powered by yaml files that can output SBOMs in a standard format. Their software repository only ha…

As mentioned correctly in [2], DNS issues with musl stem from the fact that it follows the DNS specs strictly and exposed bugs in certain DNS servers. For an HTTP server replying with 200 OK instead of an 404 Not Found upon ENOENT, the situation is clear that this is not a client-side bug. The same should be assumed of DNS/NXDOMAIN.

musl doesn't implement TCP DNS at all. When it gets a respond with the truncation bit set, it just assumes the completed records in the truncated response were sufficient, the best records even, and proceeds as if the lookup succeeded. It's hard to take seriously claims that it's strictly implementing the protocol.

Re: Wolfi: A community Linux OS designed for the container and cloud-native era

#79

Post by howenterprisey »

tptacek wrote: post #78
blueflow wrote: post #66

Earlier quoted context omitted.

As mentioned correctly in [2], DNS issues with musl stem from the fact that it follows the DNS specs strictly and exposed bugs in certain DNS servers. For an HTTP server replying with 200 OK instead of an 404 Not Found upon ENOENT, the situation is clear that this is not a client-side bug. The same should be assumed of DNS/NXDOMAIN.

musl doesn't implement TCP DNS at all. When it gets a respond with the truncation bit set, it just assumes the completed records in the truncated response were sufficient, the best records even, and proceeds as if the lookup succeeded. It's hard to take seriously claims that it's strictly implementing the protocol.

It does as of a month or so ago. https://news.ycombinator.com/item?id=36494177

Re: Wolfi: A community Linux OS designed for the container and cloud-native era

#80

Post by silisili »

bit_flipper wrote: post #70
schemescape wrote: post #65

Earlier quoted context omitted.

Can anyone help me understand musl libc and DNS issues? Note that I’m most interested in this “DNS over TCP” issue, since the other case I’ve heard of is for custom DNS setup—not for resolving host names in a default configuration . My reading indicates that DNS resolution simply might not work in certain cases. This seems like a huge problem, yet Alpine Linux is widely deployed and I think Zig uses musl libc as well…

If you use Musl 1.2.4+ (or Alpine 3.18+), there are no longer the same DNS fallback issues: https://www.openwall.com/lists/musl/2023/05/02/1 To summarize the issue: DNS is done optimistically over UDP because it's faster, but this doesn't work when DNS responses are large because of the design of UDP. TCP should be used as a fallback mechanism when responses are large. This is uncommon normally, but increasingly DNS…

I'd say he was wrong here, and his assumption was incorrect.

RFC2181 specifically says 'Where TC is set, the partial RRSet that would not completely fit may be left in the response'

'may be' being the key words. This would mean that it's up to the implementation to decide whether to include any records at all, and many do not.

Post reply on HN