Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Minimus container images are now free

images.minimus.io

Post reply on HN
Print view View original

51–60 of 80 posts

Re: Minimus container images are now free

#51

Post by morellonet »

hobofan wrote: post #50
pixl97 wrote: post #26

Earlier quoted context omitted.

>are all built continuously from upstream source 2. Isn't there a slight risk of upstream attacks being amplified by this? With the recent number of software compromises providing a way for people to use images X days old may be useful. 3. This ties into 2, if someone downloads and uses an image that is later found to be compromised they mostly have no way of being notified that happened. Not a huge issue, but is som…

> 2. Isn't there a slight risk of upstream attacks being amplified by this? I think the argument would be that consuming Minimus' containers would have a less severe amplification (or even reduction), as all upstream attacks that rely on a combination of third-party vulnerabilities would be rendered infeasible (since they reduce the amount of third-party dependencies in an image). > 3. This ties into 2, if someone do…

Also note that one of the features of Enterprise Edition is our integrations with Slack, email, GitHub, webhooks, etc. This enables really simple but powerful notification and automation scenarios based on image fixes (amongst other triggers like a version you're using going EOL).

For example, with EE, you can create an action to automatically trigger a webhook or send a Slack message when an image you're using has a critical CVE that's likely to be exploited (we also integrate threat intel from EPSS, KEV, etc).

Definitely still value in having runtime scanning / visibility too, but EE makes it easy to do purely on the 'left' side of things too.

Re: Minimus container images are now free

#52

Post by morellonet »

BIGFOOT_EXISTS wrote: post #43
morellonet wrote: post #3

John here (CTO and Co-Founder)… we’d be happy to answer any questions anyone has!

Is there a single upstream that all images are based on? Debian? Arch? Alpine? Curious how this plays into customizing images with creator, are you guys responsible for all the packaging? Would my keester be on the line if say an upstream package got hit with an attack but I use it through creator?

1. Distroless base. Imagine an effectively empty filesystem that only includes the components needed to run the app. The package manager we use is apk from Alpine and we make our full package universe of >10,000 packages available freely to Community Edition users. If you want a more 'normal' experience with a shell and apk, use the -dev versions of images that are still minimalistic but include a little more tooling like this.

2. For creator, you're basically taking any image from our public gallery and able to add whatever other packages from our universe to it, set env vars, upload files (customers typically use this for adding conf files and certificates). Then we maintain that image 'recipe' for you continuously, under the same SLAs we do all the public images. More details at https://docs.minimus.io/enterprise-edition/image-creator#ima...

3. Nope :) We are building every package across our universe continuously. Whenever there's a new version of any of them, we pull source, build package, compute what images (including creator ones) use that package, rebuild those images, test, sign.

Re: Minimus container images are now free

#53

Post by morellonet »

alfanick wrote: post #45
2OEH8eoCRo0 wrote: post #42

Supply chain attack waiting to happen

Maybe it's their business model? Sell to bunch of people and hook them in, then "get hacked", whoops sorry. Edit: honestly I'm flagging this post. This really looks like fishing for customers to make them vulnerable in future.

Not sure what you mean here. We have many enterprise customers, in industries including government, health care, financial services around the world. The whole value of the product is helping them avoid all the risk and work associated with poorly maintained container images. We publish a full SBOM for every image so you can see exactly what's inside of it. We've worked across the industry and OSS communities to enable scanning support as well, so you can easily use whatever scanning tools you currently use (e.g. Wiz, AWS Inspector, Grype, etc) to check our images.

Re: Minimus container images are now free

#55

Post by projektfu »

charukiewicz wrote: post #23

Completely blocking the image information page to mobile user agents is completely unnecessary. I'd much rather look at your non optimized page than be told to come back on desktop. Moreover, even after switching to desktop mode on my phone, there's nothing I see that precludes you from employing a little bit of CSS to make those pages render more nicely on mobile screens.

Turning on "Desktop Site" on Firefox Android lets me through. Not that I disagree, just a workaround.

Re: Minimus container images are now free

#56

Post by morellonet »

alfanick wrote: post #40
morellonet wrote: post #39

Earlier quoted context omitted.

We build all these images directly from upstream source across thousands of projects and assemble them into standard OCI images for you. We do this continuously, every time there are new versions released upstream. The point is that you can just use these images instead of what you already have and reduce your vulnerabilities by 97%+ on average. Think Docker Hub, just without the vulnerabilities.

Pinky promise? How do you prove that what I download from you is actually what you promise you've build (and that SBOM is right)? Is this certified with some digital signature? From my threat attack model, you're just yet another liability - one single service to hack all your "safe" images.

Sure, but you could make the same argument for literally any software that you're getting that was built by someone else and have not personally inspected each line of source in. For example, you could make the same argument about RHEL or any image on Docker Hub or literally anything you're not building yourself.

Respect your viewpoint and if these images aren't for you, that's totally fine of course. Many others find it useful to have someone else doing the commoditized but hard work of building thousands of components from source continuously, assembling them into ready to run images, signing, and being as open as possible about their state and configuration as possible.

Re: Minimus container images are now free

#57

Post by morellonet »

alfanick wrote: post #37
morellonet wrote: post #36

Earlier quoted context omitted.

It’s a library of near 0 CVE images available to use for free. Think Docker Hub, just without vulnerabilities. They’re all normal, OCI compliant images. You can pull them, run them, and build on them like you would any other image. arm64 and amd64 builds for everything

> just without vulnerabilities You surely mean "without known and reported vulnerabilities". I doubt you're proactively fixing the world across thousands of software packages /s

Correct, we are not claiming to be auditing the source of every software package in the world. The value we provide is a minimalistic architecture so you start with a significantly smaller attack surface and continuous builds of upstream so you stay at a near 0 CVE state without the substantial work required to do so yourself. Basically, we help you get all the upstream fixes from across the OSS ecosystem as quickly, safely, and easily as possible.

Re: Minimus container images are now free

#58

Post by morellonet »

tuananh wrote: post #41

this space is too crowded now. everyone is copying whatever Chainguard is doing - Chainguard Images - Chainguard Libraries - Chainguard VM ...

Free markets work :)

With Minimus Community Edition, you now have access to 1,000s of built from source, near 0 CVE images without cost or friction

Re: Minimus container images are now free

#60

Post by crabique »

greggsy wrote: post #25
crabique wrote: post #11

Is their ingress-nginx-controller image similar to that of Chainguard: a drop-in replacement with the CVEs fixed?

I see this is a packaging service with greater traceability and velocity than the rando images on docker hub. I believe that they will always supply the bleeding edge stable release, but it will always be your responsibility to monitor and manage issues like CVEs, rather than expecting them to do it for you.

This particular image is a bit different though.

By CVEs I mean the architectural stuff that was discovered after the original ingress-nginx repo was archived, so there is no "official" mitigation and it's not just a matter of bumping dependencies, the fixes are actual code.

Chainguard forked the repo and is maintaining their own distribution now, but it's not free.

Post reply on HN