Just run it in kubernetes and mount the certificates with trust-manager
replyWhat kind of psychopath ships 100 distinct container images? I mean, maybe if you’re talking about all of Netflix or something, but… I suspect even they have base images that they use as a starting point.
replyThere’s very little actually running in a docker container. ca-certs may actually be an exceptional case though, since it’s not code that’s running but a kind of data.
It’s not like if you use an Ubuntu image for a node.js app that you get PHP too and have the PHP vulnerability present in your web app.
You still have to rebuild each Application Container with new CACert and deploy them. Depending on teams are working, that can be disruptive.
replyI would say that if rebuilding your docker containers is a disruptive process, that is a process issue.
replyI would agree but it doesn't change the fact that many companies do not have CD and have processes that must be followed for rollouts.
replyIt's same problem we have when libraries get massive security vulnerabilities. Updating them is not always as easy as many would like.