Rotten code in a container can only get more rotten
Surströmming (technically not rotten...)
An infosec bod has documented a remote-code execution flaw in Alpine Linux, a distro that pops up a lot in Docker containers. Max Justicz, researcher and creator of crowd-sourced bug bounty system Bountygraph, said on Thursday that the vulnerability could be exploited by someone with man-in-the-middle (MITM) network access, or …
So not actually that dangerous after all.
Speaking as somebody who builds a lot of docker images I never really got the attraction to alpine - yeah it's smaller but layers render the whole thing moot; you could hide a full windows install behind layers and nobody would really care - YOUR layer might only be a few MB, that's the power of containers.
Seriously though, not convinced by the dangerous thing, it's bordering on the targetted by a state actor level - at which point you have bigger problems - and easy to fix.
Biting the hand that feeds IT © 1998–2021