> If you mean docker official images, it's just the "community" maintaining it, eg "some dudes".
replyThis is false. The Docker Official Images team (i.e. the folks with write access to the docker-library/* organization) are Docker employees.
I wasn't aware of that. So I guess it's generally better to just use plain debian images and just install the required packages with apt.
replyThere are different approaches and it all comes down to who you trust. I don't think there's universal answer. If you have money, find image provider who's serious about security and hopefully they'll provide patches images quickly. Otherwise using Debian packages is a good default I think.
replyHonestly I don't even understand why so many docker images prefer to build software from sources, rather than just installing them from debian repositories.
> I don't even understand why so many docker images prefer to build software from sources, rather than just installing them from debian repositories
replyBecause Debian uses older relases and a lot of custom patches. One example: Nodejs still doesn't have Typescript support in the Debian packages.
Distribution packages vs. official build from source has both pros and cons.
And if you're using a docker package it's often JUST BECAUSE the host Debian/Ubuntu server is out of date for things you need, and Docker's the easiest way to "patch" that.
replywelp, I guess I should have done my research into what "docker official images" actually means.
reply