Conversation

Notices

1. nixCraft 🐧 (nixcraft@mastodon.social)'s status on Tuesday, 14-May-2024 19:57:01 JST nixCraft 🐧

   Attention Linux users, developers and sysadmins: Don't forget to regularly update your Linux containers! They're essentially miniature Linux systems that need the same care and attention. By keeping them updated, you'll avoid running outdated and potentially vulnerable software like OpenSSL, PHP, Python, MySQL, PostgreSQL, and more. Protect your systems and data. Update today!

   • Bob Thomson (bobthomson70@mastodon.social)'s status on Tuesday, 14-May-2024 20:00:33 JST Bob Thomson

     in reply to

     @nixCraft one of the biggest challenges in k8s, just keeping all those base image versions updated and software supply chain security generally. A real pain point.

   • flipflap (flipflap@mastodon.social)'s status on Tuesday, 14-May-2024 20:05:00 JST flipflap

     in reply to

     @nixCraft are you referring to docker and kubernetes containers?

     I am still learning 😅

   • nixCraft 🐧 (nixcraft@mastodon.social)'s status on Tuesday, 14-May-2024 20:10:37 JST nixCraft 🐧

     in reply to

     • flipflap

     @flipflap I'm talking about all Linux containers. Docker, LXD/Incus, Podman, rkt, LXC, CRI-O etc. They all use Linux kernel features but have different management tools and use case. But at the end of the day they all need updates. That is what we need to remember.

   • nixCraft 🐧 (nixcraft@mastodon.social)'s status on Tuesday, 14-May-2024 20:53:46 JST nixCraft 🐧

     in reply to

     • defnull

     @defnull I agree. Those scanners are useful and have their place. However, it's crucial to pay attention to the email lists or RSS feeds of distributions like Debian, RHEL, or Ubuntu. These communities or companies are often the first to fix and release information about major security issues. Since containers build using the same software, you can test and redeploy/rebuild your Linux containers.

   • defnull (defnull@chaos.social)'s status on Tuesday, 14-May-2024 20:53:47 JST defnull

     in reply to

     @nixCraft BUT do not blindly trust those 'vulnerability scanners' the compliance people like so much. Hits for binaries or libraries that are not touched at all by the container at runtime are false positives. A buffer overflow in `grep` does not affect your PostgreSQL container. This unfortunately renders those scanners useless most of the time, because actual relevant warnings are drowned in false positives and you constantly rebuild images and redeploy applications for nothing.

   • IveWe (ivewe@mastodon.social)'s status on Tuesday, 14-May-2024 21:56:22 JST IveWe

     in reply to

     @nixCraft https://github.com/topgrade-rs/topgrade