Comment on Am I the only one interested in Fedora container?
marauding_gibberish142@lemmy.dbzer0.com 1 week ago
I don’t get it. Where is the idea that “Fedora focuses on security” coming from? Fedora requires an equivalent amount of work like other distros to harden it.
I personally use Alpine because I that busybox to have less attack surface than normal Linux utils
tripflag@lemmy.world 1 week ago
Alpine also has the advantage of musl, which is a safer alternative to glibc, at the cost of some performance. So, if anything, I’d expect people to consider alternatives to Alpine for that reason, as alpine is already the best choice for security.
marauding_gibberish142@lemmy.dbzer0.com 1 week ago
Alpine isn’t exactly fortified either. It needs some work too. Ideally you’d use a deblobbed kernel with KSPP and use MAC, harden permissions, install hardened_malloc. I don’t recall if there’s CIS benchmarks or STIGs for Alpine but those are very important too. These are my basic steps for hardening anything. But Alpine has the advantage of being lean from the start. Ideally you’d compile your packages with hardened flags like on Gentoo but for a regular container and VM host that might be too much (or not - depends on your appetite for this stuff).