Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exploiting Alpine Linux

twistlock.com

Post reply on HN
Print view View original

21–25 of 25 posts

Re: Exploiting Alpine Linux

#21

Post by cupcakestand »

mschuster91 wrote: post #16
cupcakestand wrote: post #15

Earlier quoted context omitted.

> Stuff like this is why I base my docker images off Ubuntu or Debian and regularly rebuild them. How can a server running Docker rebuild itself a new image and deploy it? Without your intervention. With cron?

I do it the "old fashioned" way. Manually build the images on the laptop, increment the version prior to pushing it to Nexus, and then increment the version in DC/OS. Reminds me, I actually could automate this using Jenkins, it has an interface to Marathon (which backs DC/OS)...

If you want to automate it just use unattended upgrades for security updates within the container.

Re: Exploiting Alpine Linux

#22

Post by mschuster91 »

cupcakestand wrote: post #21
mschuster91 wrote: post #16

Earlier quoted context omitted.

I do it the "old fashioned" way. Manually build the images on the laptop, increment the version prior to pushing it to Nexus, and then increment the version in DC/OS. Reminds me, I actually could automate this using Jenkins, it has an interface to Marathon (which backs DC/OS)...

If you want to automate it just use unattended upgrades for security updates within the container.

This works for sure but is ephemeral - when you have to restart the container for unrelated reasons, the upgrades are lost.

Re: Exploiting Alpine Linux

#23

Post by mschuster91 »

Gigablah wrote: post #13
mschuster91 wrote: post #4

Stuff like this is why I base my docker images off Ubuntu or Debian and regularly rebuild them. This way I always get the security updates from Debian/Ubuntu. The problem with all images which base on something that is not an official distro image is that these packages always have to depend on the base image author to regularly update the images. There is no such thing as apt-get upgrade in a docker only environment…

I don't understand your conclusion. The exploit in the article was reported to the Alpine Linux maintainers and the fix was promptly made to apk-tools ( https://git.alpinelinux.org/cgit/aports/commit/?id=b849b481a... ), so if you rebuilt a docker image based off Alpine you'd have gotten the security update like you described.

> so if you rebuilt a docker image based off Alpine you'd have gotten the security update like you described.

Only if I directly base off my image from Alpine. All images that base off something that either directly bases off Alpine (or worse, with more intermediaries) have a problem as ALL images in the chain must be rebuilt.

That is the core problem.

Re: Exploiting Alpine Linux

#24

Post by Gigablah »

mschuster91 wrote: post #23
Gigablah wrote: post #13

Earlier quoted context omitted.

I don't understand your conclusion. The exploit in the article was reported to the Alpine Linux maintainers and the fix was promptly made to apk-tools ( https://git.alpinelinux.org/cgit/aports/commit/?id=b849b481a... ), so if you rebuilt a docker image based off Alpine you'd have gotten the security update like you described.

> so if you rebuilt a docker image based off Alpine you'd have gotten the security update like you described. Only if I directly base off my image from Alpine. All images that base off something that either directly bases off Alpine (or worse, with more intermediaries) have a problem as ALL images in the chain must be rebuilt. That is the core problem.

TBH you'd have the same problem if you based your image off an intermediate Debian/Ubuntu-based image.

I always build my images directly off Alpine anyway, or a base image that I control.

(In this case though, the security fix is for the apk-tools package and not the distro itself, so as long as you have apk update+upgrade in your final build, whether the intermediate images are rebuilt doesn't matter.)

Post reply on HN