I've rewritten the exporter's Dockerfile into a better image:
Runs as a non-root user, which adds a layer of protection should the container runtime have a vulnerability that requires root privileges inside the container (which has happened before)
Builds ssl_exporter during build time, so that Docker Hub builds can be trusted, instead of trusting the maintainers to docker push authentic binaries
Does not include busybox and all it's tools, which go unused inside the image but could be leveraged by an attacker should the image be flawed
A bit more efficient in space (about 1.2MB less)
Adds an EXPOSE clause for 9219/tcp, just for correctness
The image's filesystem tree is less tall (as you can see using dive):
I've rewritten the exporter's Dockerfile into a better image:
root
user, which adds a layer of protection should the container runtime have a vulnerability that requiresroot
privileges inside the container (which has happened before)ssl_exporter
during build time, so that Docker Hub builds can be trusted, instead of trusting the maintainers todocker push
authentic binaries1.2MB
less)EXPOSE
clause for9219/tcp
, just for correctness