Hacker News Reader

Comment by catern | Hacker News Reader

It's quite ironic that the biggest usage of Alpine, a distro whose tagline is "Alpine Linux is a security-oriented, lightweight Linux distribution based on musl libc and busybox.", is Docker, which is an almost completely opposite technology: vastly overcomplicated, insecure, and bloated. I'd be interested to hear what the Alpine maintainers think of their biggest user...

View on HN

> I'd be interested to hear what the Alpine maintainers think of their biggest user...

The creator of Alpine Linux, Natanael Copa, reportedly went to work for Docker, so presumably Natanael thinks it's a reasonable use-case. Solomon Hykes, Docker's CTO at the time, posted about it on HN: https://news.ycombinator.com/item?id=11000827

Alpine Linux, as I understand it, strives to be a lightweight and minimalist distribution of Linux. That's exactly what you'd want to run as a container, assuming you are going to run a Linux distribution and one that's different than the production host system.

Aren’t minimalist operating systems often meant to run as guests under more complicated virtualization layers? Limited driver support, for example, can be an important part of the minimalism.

People believe that security is like salt. Just sprinkle it on top and it somehow makes the whole thing better.

It could be fair to call the docker ecosystem bloated and insecure, but I would argue that a single (Alpine based) docker container is a secure, simple, and elegant solution.

Docker is vastly over complicated? It’s one file jotting down a setup, and two commands, build and run and your up and going. How could it possibly be simpler? Bloated? It takes up almost no space and the docker image containers in large part thanks to alpine run less than 50MiB unless you are using huge dependencies at which point there is no way around it anyway. As for insecure, what’s the issue? We’re running untrusted code in containers and have had no issues but I’d love to hear where the model breaks down.

out of curiousity, where you say Docker is "insecure" what specific aspects of Docker were you thinking of?

The docker daemon runs as a privileged user, so if you're able to break out of the container (which has been shown possible recently) then you can compromise the entire host OS.

Could you provide a reference for how to break our?

https://www.twistlock.com/labs-blog/breaking-docker-via-runc...

This is from a CVE that was released a little over a month ago.

That was a runc vuln, which affected other conatinerization solutions on Linux, not just docker.

Also it didn't really have anything to do with the Docker daemon running as root, it was triggered by the use of root users in containers (blocked if the user didn't do that, had decent SELinux setups or used user namespaces)

Reply on news.ycombinator.com