All right. 1
So something I wanted to talk about this week and I would love to hear your thoughts on this in the 2
comments whether or not you're doing it or you're concerned about it is some great stuff that Dr. captains 3
we're talking about in our select chat a couple of weeks ago I think might even have been last week 4
or the week before but it was more about some articles that came out and one specifically a couple of 5
months ago three or four months ago around container security scanning and what that really means is 6
your images that you're doing inside inside of Docker that are the building blocks for your containers. 7
Those are storage for your app as the dependencies as well. 8
So the nice thing about that image is that it now becomes a really great place to scan for known vulnerabilities 9
or potential security flaws in code and in applications and dependency. 10
So we call that container scanning or image scanning. 11
There's different sort of terminology in the industry but there's lots of scanners out there and there's 12
more than a few. 13
And those all have pros and cons and if you're if this sounds familiar. 14
This is very similar to the old antivirus wars where we had different antivirus scanners that would 15
pick up on different things. 16
But nowadays with container scanning the one that we typically talk about first is using the open database 17
of known. 18
That's the keyword there is known vulnerabilities in open source software primarily open source software 19
but it's not exclusive to open source. 20
It just happens to be mostly open source because that's where we tend to find allow the flaws because 21
we can see the source. 22
So we end up as an industry figuring out where the problems are quicker. 23
So that stuff has a database of known vulnerabilities it's updated all the time. 24
And so there's scanners out there some free some not that will scan your image and its dependencies. 25
So not just your app but also any app to get dependencies that are installed you know things like Open 26
SSL or even curl if there's a vulnerability in that and you have that in your container image. 27
These scanners are supposed to help you find those vulnerabilities so that you can update them and hopefully 28
apply a fix and some interesting conversation came out about an article from this guy Steven and it 29
was around that these scanners all have different pros and cons right some detect problems some detect 30
other problems and they maybe don't all the tech the same thing. 31
But at the end of the day one of the things in Linux they really depend on is the operating system or 32
in this case the base image like you boon to Debian S.O.S. 33
Alpine stuff like that. 34
Those different base images often need to translate where the files are on the system and what program 35
those files relate to maybe like the open source Open SSL libraries for providing SSL to your web servers. 36
So those files will exist on the operating system somewhere in a file path and they all come together 37
in a package and that those vendors need to supply the scanners essentially a translation to figure 38
out for the scanners to find where the packages live. 39
OK. 40
So that's the background. 41
And it turns out that not all operating system distributions of Linux provide that functionality and 42
they don't all provide it as well as others. 43
So this can cause problems if you're going to scan for vulnerabilities. 44
In other words your base image whether it's Ubuntu or S.O.S or Red Hat or alpine that now matters in 45
terms of you being able to scan the complete database of known don't vulnerabilities in that image. 46
All right and one interesting point that I think came at that through this article and by the way I'll 47
throw this article in the live chat. 48
You can check that out. 49
An interesting point that was made is that right now as it is down here at the bottom it talks about 50
the Alpine problem which I think is a pretty interesting discussion around we as container makers. 51
Maybe someone who makes containers or at least is interested in making containers. 52
And if you make those images one of your concerns right is security and security often has you know 53
we try to lump sum everything into it is secure or it is we have done security and that's really not 54
a thing right. 55
We all. 56
If you've been there long enough you know that security is a lot of things and there is no such thing 57
as truly secure. 58
Right. 59
Maybe we always joke that the most secure system is one that's turned off. 60
So when you talk about your software there's lots of things to consider and Alpine is a really great 61
distribution and that provides a base image Alpine Linux 62
and one of the best parts about it is that it's very very minimal it's very small comes in at around 63
5 Meg which is crazy small compared to something like a boon to or S.O.S. 64
Now you can compare that in the full operating system since but we're really just talking here about 65
the images themselves the container image is not your host OS. 66
I don't want to talk about host OS is I really want to just talk about your base images for your containers 67
because what I see in the industry and we love to talk about this online is what's the cool cool trendy 68
thing that the Zeit Geist of our community has sort of caught on to and I think in the last couple of 69
years Alpine has risen in popularity a lot to do with the fact that it has such a small image for containers 70
so that's a good thing. 71
And if you you know I have even done this but if I Googled you know secure Docker base image if you 72
start looking around there if I just search for the word Alpine it's not showing up on this page. 73
So that was a Google fail but what I would expect to see is people talking about Alpine because a lot 74
of the industry likes to recommend Alpine as a way to get automatic security or better security out 75
of the box. 76
And the reason that we're arguing for that is that is small. 77
So if it's smaller that means less files less potential vulnerabilities less things to pin it to to 78
potentially patch. 79
Right. 80
And this has been something we've been doing for decades back in the Windows 2000 era 2008. 81
I remember when Windows 2008 came out Microsoft had a new version called core that was a smaller version 82
of Windows Server. 83
And at the time one of the biggest arguments was better security through less patching. 84
And so if you in theory if you have less software on the machine then there's less to worry about in 85
terms of patching and potential vulnerabilities. 86
So that's in our Pyne's case that's one of their reasons for arguing that they're more secure but space 87
isn't always the number one factor in fact as an operator as someone who runs servers for a living I 88
don't see this space as cheap. 89
You know 100 meg of this space even if it's times five images is fine to me I don't need to save five 90
hundred megs of space on my servers. 91
What you know typically I'm not backing up full operating systems you're usually focused on application 92
backups most of the time especially now in the cloud where we're not doing image based server backups 93
if that was something that you were ever into. 94
Back in the old days where to do full image backups and so a lot of our backups were just the entire 95
operating system over and over again. 96
Well we don't do that so much I think as an industry especially cloud native nowadays and I think that 97
when we talk about images and size size is not even one of my top three factors really in terms of an 98
image and its quality. 99
So when I look at an image and potential security concerns or whatever or just using of an image whether 100
or not it's a gig or 20 meg at the end of the day I'm not so concerned I just need to plan for that 101
because ultimately it maybe is a cost in storage but that cost is one of the cheapest things on my list 102
of costs right. 103
Humans being the most expensive thing and then other things like computing power in terms of CPE memory 104
networking those are always to me more expensive than disk. 105
So I don't tend to recommend to people to do Alpine out of the gate. 106
In fact if you've ever seen me talk about Docker production you know that one of the things I talk about 107
is sticking with what you know stick with Debian stick with Ubuntu stick with sent OS stay with those 108
images if that's what you're used to because Alpine is a lot different it's got a different package 109
manager it's that different file locations so you're gonna have to end up changing a lot of your app 110
just to use Alpine and in most cases now some cases if you're using go or maybe no J or something you 111
probably don't have to change a lot. 112
But even recently I have seen in just the last year and especially in the last three months I've seen 113
a multiple other indicators for why maybe you shouldn't be using Alpine as your base image and this 114
really isn't about throwing shade at Alpine and saying that outlines bad. 115
It's really about do we really need to do the extra work of implementing Alpine just for the sake of 116
more security and smaller images so I might not my argument is going to be I don't think that's even 117
necessary and if we consider this new sort of discussion around the Alpine problem in this blog article 118
is to say that alpine right now maybe isn't the best place because it's really hard if not impossible 119
to scan for security vulnerabilities in the CV known database that database of common vulnerabilities 120
that you can't actually do that yet with alpine that you and you can do that with some other ones you 121
boon to Debian Red Hat stuff like that. 122
So if you're someone who's going to use a security scanner Alpine is actually a bad thing for you. 123
Another thing I've noticed recently is that alpine sometimes has sneaky problems that sneak up on you 124
in part and in ways you wouldn't expect. 125
I recently had some some students tell me that trying to get Alpine working with node Mohn has known 126
problems. 127
And I did. 128
I didn't I was not aware of this. 129
I didn't test it but people have come back to me and said using Alpine with their no J.S. node mine 130
and Node minus something and no J S is is for using for file monitoring to automatically restart your 131
node app whenever files change. 132
That's really good for development but evidently they've had problems with alpine when they wouldn't 133
have had problems with Ubuntu and Debian and I'm only bringing this up because it's an important factor 134
to consider when you're going to go and implement a new base image. 135
So a lot of people come to me and and say what do you think of Alpine should I switch everything to 136
Alpine. 137
Should I take all of my images that I'm building on Debian or immune to or S.O.S or something else. 138
And should I shift all of those to go to Alpine because I hear it's smaller and more secure and I and 139
my answer honestly nowadays is it's more complicated than that and you probably should consider it but 140
also maybe just not like stick with what you're good at and what you know the scanners work with years 141
probably you can use the default images because all official images that are default from Docker such 142
as let's just go look at the node 1. 143
So the no default images all default to using Debian underneath which is larger slightly larger maybe 144
80 Meg larger than than the Alpine image but 80 Meg. 145
I mean that's just as a small factor that it's not to me a big motivator unless I'm maybe on some sort 146
of you know IO T device maybe something like that. 147
You know on the edge or something where I have a really small flash drives or something that might be 148
a concern. 149
But if you go look at the default images if you didn't realize this in the background all these default 150
images are you know if you just type Docker run node or duck or run my sequel. 151
Those are all gonna run on Debian by default because that's how Docker was building them to begin with 152
six years ago. 153
But all of these now have Alpine options. 154
So you would maybe say my sequel colon Alpine and use the tag for Alpine and that's fine but it doesn't 155
mean that you automatically get a better experience all the time right. 156
Not all packages are even available in the Alpine package manager. 157
In fact I for my own use I have to keep security tools or different utilities that I have some of them 158
work in Alpine and some just don't. 159
And I quite frankly don't want to go and manually figure out how to build them because they fail to 160
build and I don't still want to troubleshoot that because of different libraries. 161
So I just leave a Debian for most of my tools and I use other ones through Alpine. 162
And at the end of the day I know that almost everything is going to work on Debian out of the box because 163
the app to get package manager or apt apt package manager is sort of like the king of package manager 164
is everything there. 165
If there's a package for something it's probably gonna be an apt. 166
Right. 167
You might not see something in Yum. 168
You might not see it in our Pyne's package manager but it's always going to be an apt and at comes with 169
Debian and Ubuntu and other variants of those base images. 170
So when you're thinking about images and the sum all this up when you're thinking about images and you 171
want to build your base images security is definitely a factor. 172
But one of those if you're really concerned about security is you're going to want to scan your images. 173
So if you're gonna want to do that alpine may be a disadvantage for you. 174
In that case so definitely read this article since I threw it up in the in the text there. 175
Another thing is does the space benefit really matter to you. 176
You know if if you're losing a little bit on the potential security and you're image size doesn't matter 177
as much especially if you're someone who has you know 800 or 900 mag images which are common when you're 178
dealing with things like you know Java or HP and stuff like that. 179
Those are commonly very large images comparative to 80 Meg or a five Meg. 180
So think about that stuff a little bit. 181
Don't just automatically switch all your stuff because you heard outline was more secure. 182
Obviously there's lots of other security advantages to Alpine since it is small. 183
It does have very few potential vulnerabilities in it but it does have vulnerabilities right it's not 184
impervious to software vulnerabilities it's just maybe less so. 185
The Ubuntu and Debian. 186
The last thing I'll say on this is if you have not looked at the other from images such as Ubuntu and 187
Debian those images are getting smaller over time and I'll just show you for example. 188
It is actually little pet peeve of mine because things are getting pulled out of these images and new 189
versions that used to be in old images and that can actually cause problems in your software. 190
For example paying or IP config or maybe even the P S command. 191
Things that were maybe in the image years ago that you were used to are maybe no longer in those default 192
images on current versions and that can be a little bit of a problem if you assumed that they would 193
always be there. 194
So nowadays I've got in the habit of even if I'm using a boon to image out of the box maybe I'm using 195
the default images which use a Debian I will. 196
I will also go through doing an apt get install of even things like you know the P S command for process 197
listing or curl or whatever I might need right paying or something and that's just to make sure that 198
in the future versions if they ever take those things out I will always have them in my image because 199
I've made a custom image installing those. 200
So if I just do a Docker image L S here I don't have a cleaned up machine so no I do. 201
Actually I've only got a couple here so if I do a Docker image 202
pull of let's just do 203
Ubuntu and then let's do debut in 204
and then let's do Alpine because these numbers change all the time. 205
I'm not actually sure what the most frequent numbers are what the current status is so let's do that 206
Docker image less again and. 207
Right so Alpine comes in at five and a half meg pretty crazy right. 208
If you get into the whole reason behind that it's actually pretty cool about how they build static binaries 209
and stuff linked binaries so that doesn't really small. 210
If you look at Ubuntu a boon to 211
three years ago was probably one hundred and twenty Meg. 212
Hundred and thirty Meg at least. 213
And now it's down to eighty seven and the current version of Debian is 1 to 1. 214
Which is weird because you would normally think that a boon to is normally bigger than Debian and I'm 215
not sure that that's changing in the next release of Debian. 216
There's someone in chat probably knows this answer faster than I do but I think there might be 217
version 218
C experimental maybe 219
it's too experimental. 220
I'm just gonna guess that it's smaller 221
and remember while we're doing this that if you're thinking about your as well I might have 100 hundred 222
containers running. 223
Remember that assuming they're all using the same base layer that layer is only taking up one one time 224
on that on the offering system. 225
As long as you keep your image clean by auto pruning them as in as long as you do things like making 226
sure that most of your apps you're running are within one or two versions of the base images so that 227
you're not you don't have all the versions on the server then you're not going to take up a lot of space 228
with this stuff right. 229
All right let's look at experimental. 230
It's actually bigger. 231
That's a bummer. 232
I seem to remember at some point last year reading about a boon to and Debian moving to something and 233
they have their own slim slim there's something a little bit different. 234
It definitely keeps a lot more out of there but you might wonder how these things are getting smaller. 235
It's not because they're zipping them up or compressing them anymore it's that they're actually just 236
pulling out tools that aren't essential or pulling out libraries that are no longer needed for those 237
core tools. 238
And that's why things like P.S. and paying and kernel and other utilities are disappearing from these 239
images. 240
So just be wary of that all right. 241
So I think it's a great discussion and I look forward to hearing your comments and reading your comments 242
about this in this. 243
I'm actually planning on updates to a couple of my courses to talk about this and give a little bit 244
more information on Alpine and why when and why you may want to choose it over a different version of 245
a base image because it is a good discussion and there's obviously lots to talk about lots of different 246
reasons for choosing a base image over another one.