upvote

points

by dmtroyer10 hours ago |
comments
upvoteby janmo10 hours ago|
next
[-]
They had almost a full day to prepare for this...
reply
upvoteby bombcar9 hours ago|
parent|
[-]
I'm starting to suspect that they actually got the notice the same time we did, because if they got the patches there should be no reason it wasn't already built and ready to go (unless they're scared that "our build servers are public and everyone will know" so they literally held everything off until the release which seems so counterproductive as to be ... well, open-source silliness).
reply
upvoteby b11210 hours ago|
prev|
[-]
If you mean docker official images, it's just the "community" maintaining it, eg "some dudes". By no means should you consider it a mechanism to get timely security updates, I've seen horrible lag on that before.

Most of docker is like this. Images provided by volunteers, and not related to the project. Using docker images you don't maintain yourself, and at least don't upgrade yourself, is not the best recipe for security.

(It's pretty trivial to build your own)

reply
upvoteby TimWolla4 hours ago|
parent|
next
[-]
> If you mean docker official images, it's just the "community" maintaining it, eg "some dudes".

This is false. The Docker Official Images team (i.e. the folks with write access to the docker-library/* organization) are Docker employees.

reply
upvoteby andix10 hours ago|
parent|
prev|
next
[-]
I wasn't aware of that. So I guess it's generally better to just use plain debian images and just install the required packages with apt.
reply
upvoteby vbezhenar9 hours ago|
parent|
[-]
There are different approaches and it all comes down to who you trust. I don't think there's universal answer. If you have money, find image provider who's serious about security and hopefully they'll provide patches images quickly. Otherwise using Debian packages is a good default I think.

Honestly I don't even understand why so many docker images prefer to build software from sources, rather than just installing them from debian repositories.

reply
upvoteby andix9 hours ago|
parent|
[-]
> I don't even understand why so many docker images prefer to build software from sources, rather than just installing them from debian repositories

Because Debian uses older relases and a lot of custom patches. One example: Nodejs still doesn't have Typescript support in the Debian packages.

Distribution packages vs. official build from source has both pros and cons.

reply
upvoteby bombcar9 hours ago|
parent|
[-]
And if you're using a docker package it's often JUST BECAUSE the host Debian/Ubuntu server is out of date for things you need, and Docker's the easiest way to "patch" that.
reply
upvoteby dmtroyer10 hours ago|
parent|
prev|
[-]
welp, I guess I should have done my research into what "docker official images" actually means.
reply