alt Hacker NewsYes - difficulty in shipping security updates to a hundred different container images, each of which is vulnerable in their own slightly-different way because they all decided to ship an OS alongside their app - is one of the top criticisms of the docker way of doing things
Replies
> docker
If only we could somehow share libraries and configuration files across apps rather than duplicating them and having to update them for every app individually.
We could call it a "shared library" system and an "operating" system. Someone should really invent this.
I mean, even docker could maybe use a shared base image or something right? ;-)
What kind of psychopath ships 100 distinct container images? I mean, maybe if you’re talking about all of Netflix or something, but… I suspect even they have base images that they use as a starting point.
There’s very little actually running in a docker container. ca-certs may actually be an exceptional case though, since it’s not code that’s running but a kind of data.
It’s not like if you use an Ubuntu image for a node.js app that you get PHP too and have the PHP vulnerability present in your web app.
Just run it in kubernetes and mount the certificates with trust-manager