search

mozilla-services / Dockerflow

Cloud Services Dockerflow specification
Apache License 2.0
199 stars 28 forks source link

Do not recommend alpine #48

Closed sciurus closed 5 years ago

sciurus commented 5 years ago

Based on our IRC conversation, we do not want people to use the alpine variants of images.

sciurus commented 5 years ago

Thanks @jbuck ; fixed.

I noticed that the old Dockerfile installed the application as the app user. This meant the app user owned the node modules and thus could write to them, counter to our own recommendation that "this user is for privilege deescalation and should have read-only access to files". I've fixed that.

I still had to make the /app directory writable by the app user, otherwise npm run failed with a complaint that "npm update check failed"

mostlygeek commented 5 years ago

Curious, what are the problems supporting alpine containers?

sciurus commented 5 years ago

@mostlygeek "the alpine problem" section of https://kubedex.com/follow-up-container-scanning-comparison/ and https://irccloud.mozilla.com/file/Vpu2c8RQ/Screen%20Shot%202018-12-10%20at%2010.50.24.png go into the issues

mostlygeek commented 5 years ago

@sciurus those are very good reasons not to use alpine. The -slim packages seem like the right trade off between size and security then for us.

sciurus commented 5 years ago

@jbuck take another look when you get a change.