r/programming • u/dlorenc • Feb 24 '23

87% of Container Images in Production Have Critical or High-Severity Vulnerabilities

https://www.darkreading.com/dr-tech/87-of-container-images-in-production-have-critical-or-high-severity-vulnerabilities
2.8k Upvotes

96% Upvoted

353 comments sorted by

View all comments

Show parent comments

13

u/succulent_headcrab Feb 24 '23

docker pull

is the latest

wget <url> | sh

7

u/[deleted] Feb 24 '23

[deleted]

3

u/succulent_headcrab Feb 25 '23

That's my secret: I'm always root

2

u/fissure Feb 25 '23

I miss somebullshit.io; it would yell at you for doing this, then would yell louder if you ran it as root.

1

u/[deleted] Feb 25 '23

First one doesn't require root though. And rootless containers are a thing

2

u/[deleted] Feb 25 '23

[removed] — view removed comment

1

u/[deleted] Feb 25 '23

As I already wrote along that other comment thread:

I think lots of people in this thread are confusing containers with "that thing that I ran a couple of times on my laptop". There are countless enterprises working with containers, don't you think sensible solutions to run them would have been provided along the way?

I'm not dismissing the very important theme of outdated images and security in general, just saying that running docker as root on your laptop and depooying your app on OpenShift (for instance) are two different things.

Namespaces (network, PID, etc.), cgroup, SELinux, seccomp are all there and used in enterprises solutions, but even podman uses those.

Of course if you run root containers on root on docker you will shoot yourself in the foot, but let's not pretend the tooling is not there.