Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Minimal – Open-Source Community driven Hardened Container Images

github.com

Post reply on HN
Print view View original

1–10 of 33 posts

Show HN: Minimal – Open-Source Community driven Hardened Container Images

#1

Post by ritvikarya98 »

I would like to share Minimal - Its a open source collection of hardened container images build using Apko, Melange and Wolfi packages. The images are build daily, checked for updates and resolved as soon as fix is available in upstream source and Wolfi package. It utilizes the power of available open source solutions and contains commercially available images for free. Minimal demonstrates that it is possible to build and maintain hardened container images by ourselves. Minimal will add more images support, and goal is to be community driven to add images as required and fully customizable.

Show HN: Minimal – Open-Source Community driven Hardened Container Images
github.com

Re: Show HN: Minimal – Open-Source Community driven Hardened Container Images

#3

Post by debarshri »

This is great. I have been talking to quite some vendors in the space. I have looked in docker hardened images too. They have made it free too.

I think the problem in general is hardened image market is keeping up with CVEs and making sure the catalog is vast so that it covers all the images and nuances.

Responding and patchibg CVEs with an SLA is the KPI of the vendors. As much as I would like cheer for you, doing it as an opensource initiate with a guaranteed SLA is going to be painful for you as maintainer without profit as a motive.

Re: Show HN: Minimal – Open-Source Community driven Hardened Container Images

#4

Post by [deleted] »

debarshri wrote: post #3

This is great. I have been talking to quite some vendors in the space. I have looked in docker hardened images too. They have made it free too. I think the problem in general is hardened image market is keeping up with CVEs and making sure the catalog is vast so that it covers all the images and nuances. Responding and patchibg CVEs with an SLA is the KPI of the vendors. As much as I would like cheer for you, doing i…

[deleted]

Re: Show HN: Minimal – Open-Source Community driven Hardened Container Images

#6

Post by ritvikarya98 »

debarshri wrote: post #3

This is great. I have been talking to quite some vendors in the space. I have looked in docker hardened images too. They have made it free too. I think the problem in general is hardened image market is keeping up with CVEs and making sure the catalog is vast so that it covers all the images and nuances. Responding and patchibg CVEs with an SLA is the KPI of the vendors. As much as I would like cheer for you, doing i…

Thanks for looking into this! I agree with you and hence I'm also relying on Wolfi packages, which will ensure they are updated as soon as upstream is available so I'm piggy backing on that. Github Actions run daily/weekly based on the cadence and once the pipeline is setup do not require a significant effort imo. And I want it to be community driven so we can add images as and when people want it and build it accordingly. Chainguard tools surely help with this! I aim to show that companies can try and build internal pipelines like this for all images in their repository

Re: Show HN: Minimal – Open-Source Community driven Hardened Container Images

#8

Post by adriand »

Dumb question but how would these work in practice? I use kamal to deploy containerized applications. Would I on a regular basis update the versions of the underlying images to match the latest hardened container and then redeploy? I assume this is automatable?

Re: Show HN: Minimal – Open-Source Community driven Hardened Container Images

#10

Post by tigerinthe »

Joel_Mckay wrote: post #7
anukritisingh wrote: post #5

Looks very useful, we should definitely build up on this!!!

Hard pass... In general, a public security policy is pointless. It is the one layer you want people to trip over when breaking a system. =3

Why do you say so?
Post reply on HN