Comment

Comment on Container Vulnerability Management

Why not use PHP hardened (distroless) images as a base for the final image?

Why build your own images at all? I’m not sure I understood what advantage that gives you.

Harbor looks interesting but that install procedure is ridiculous. Why would I run an installer script just to pull docker images, just give me a compose file ffs. The only way I’d ever consider it is inside an LXC container or a VM.

Also, it sounds like they’ve never heard of a reverse proxy and don’t know you can do TLS that way? That does not inspire confidence.

source

Sort:hotnew top

surewhynotlem@lemmy.world ⁨3⁩ ⁨days⁩ ago

Why build your own images at all?

Trust. A LOT of docker images are just some person who decided to do it first. Hopefully php has an official one though.

source
- lambalicious@lemmy.sdf.org ⁨3⁩ ⁨days⁩ ago
  PHP does have a number of official ones, yes, but the way they are designed still makes it often more efficient to just download their Dockerfiles and use as a guide to make your own (I’ve had to do that in particular because of how difficult it is to install some specific PHP extensions on their Alpine image sets).
  
  source
niclas@infosec.pub ⁨3⁩ ⁨days⁩ ago
PHP hardened (distroless) images

That’s a good point, maybe I’ll change that at some point. The reason, haven’t done so yet is that I wanna have the whole supply chain under my control. And know exactly what has been changed since a release.

Why build your own images at all?

Because of two different reasons:

Flexibility: I can modify a container to my needs.

Trust: I don’t wanna rely on something that I don’t have under control. An image might contain some breaking changes in the next version, and that could cause me problems when I apply them.
source