Submitted 22 hours ago by eskuero@lemmy.fromshado.ws to selfhosted@lemmy.world
I’m talking not only about trusting the distribution chain but about the situation where some services dont rebuild their images using updated bases if they dont have a new release.
So per example if the particular service latest tag was a year ago they keep distributing it with a year old alpine base…
Rebuilding containers is trivial if they supply the dockerfile. Then the base image is up to date, and you can add any updates/patches for things like the recent react vuln.
I didn’t realise this was a problem.
I’m not too worried about it though.
each container has such a small attack surface. As in, my reverse proxy traefik exposes port 80 and port 443, and all the others only expose their API’s or webservers to traefik.
Not currently, but am planning on getting to it in 2026. I want to pull things to my Forgejo and use some workflows there to scan for vulnerabilities amd rebuild’n tweak images i deem necessary. It will be a fun project.
Almost never. I don’t see any benefit .
rn I’m only using docker for the services I have behind a VPN, so I don’t really put that much thought into securing them. If I had any publicly accessible ones I would setup an automatic patch or even build my custom images.
And as always I’m trying to up my security game, but not at any cost
I don’t think a year old base is bad. Unless there’s an absolutely devastating CVE in something like the network stack or a particular shared library, any vulnerabilities in it will probably be just privilege escalations that wouldn’t have any effect unless you were allowing people shell access to the container. Obviously, the application itself can have a vulnerability, but that would be the case regardless of base image.
Rebuild: no. If the software itself is unmaintained, it gets replaced.
Patch: yes. If the base image contains vulnerabilities that can be fixed with a package update, then that gets applied. The patch size and side effects can be minimized by using copacetic, which can ingest Trivy scan results to identify vulnerabilities.
There’s also repos like Chainguard and Docker hardened images which are handy for getting up to date images of commonly used tools.
All the time. There’s a lot of cves in old premade docker containers.
No
I did it only once (yet) because i needed a specific addon for the software.
In my case, I wanted to use caddy webserver with a specific plugin. It was quite easy to create a new image exactly the way i wanted it.
I don’t know enough about code to verify things myself. And I assume this applies for a lot of us here. So I just pray that nothing’s fucked in the distribution chain.
I’m also in this category, but OP is talking about something else.
Like if you use container-x, which has an alpine base. If it hasn’t released a new version in several years then you’re using a several year old alpine distro.
I didn’t really realise this was a thing.
Ah, I have no idea what that is. I thought OP meant building stuff directly from Github (e.g. Ungoogled Chromium). Thanks for the clarification! :)
Yes, because I mostly like to have my services built in a Debian container inside my Proxmox environment. If I’m running it in Docker, there’s a good chance it’s temporary/PoC, and in that case I do not rebuild or anything, I run it for whatever purpose it serves and then it either goes away or gets migrated to a handcrafted Debian container.
Not yet but I plan to. Just haven’t gotten around to setting it all up yet.
I have a repo for some home automation, where some hardware specific modules are required. But it’s becoming rarer since more software handle it in runtime.
I’ve never rebuilt a container, but I also don’t have any containers that are deprecated status either. I swap off to alternatives when a project hits deprecation or abandonware status.
File browser Quantum is quite the popular replacement, if you don’t need any of the things it hasn’t implemented yet, and especially if you enjoy all the new things it can do!
B0rax@feddit.org 21 hours ago
No. I only have a limited amount of time for maintaining my home infrastructure. I chose my battles.
jimmy90@lemmy.world 6 hours ago
i do look out for new images that could be a drop in replacement
the new no-distro movement of containers is very interesting