Slim(toolkit): Don't change anything in your container image and minify it by up to 30x (and for compiled languages even more) making it secure too! (free and open source)
Apache License 2.0
19.24k
stars
717
forks
source link
Differences between seccomp profiles generated via `build` and `profile` commands #308
By reading the documentation of the project, I was expecting that docker-slim profile was running the exact same part of the app that generates the seccomp profile while doing docker-slim build.
Actual Behavior
It seems that it's not the case, I have a concrete example just below that produces two different seccomp profiles and one doesn't work as it prevents the container to start correctly. The one built with docker-slim build seems to work very well, and congratulation on that 😸 ! That's an impressive feature!
And unfortunately you get (like stated by Skybound in the previous answers)
docker: Error response from daemon: OCI runtime create failed: container_linux.go:380: starting container process caused: close exec fds: ensure /proc/self/fd is on procfs: operation not permitted: unknown.
Expected Behavior
By reading the documentation of the project, I was expecting that
docker-slim profile
was running the exact same part of the app that generates the seccomp profile while doingdocker-slim build
.Actual Behavior
It seems that it's not the case, I have a concrete example just below that produces two different seccomp profiles and one doesn't work as it prevents the container to start correctly. The one built with
docker-slim build
seems to work very well, and congratulation on that 😸 ! That's an impressive feature!Steps to Reproduce the Problem
I was trying something like that:
And unfortunately you get (like stated by Skybound in the previous answers)
But then I took a look at your examples repo and saw that : https://github.com/docker-slim/examples/blob/master/3rdparty/nginx_alpine/slim.sh
And this works perfectly!
Specifications
linux|Transformer|1.37.5|86fbd29ab3549fa564e87e4770178480cb0542d3|2022-03-21_06:10:20AM
Linux aqua 5.11.0-49-generic #55-Ubuntu SMP Wed Jan 12 17:36:34 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux