How I manage my Containers and their Vulnerability Management across selfhosted infrastructure and how the patching of PHP2SHELL looked like
You must log in or register to comment.
You might be interested in: https://github.com/project-copacetic/copacetic
Why not use PHP hardened (distroless) images as a base for the final image?
Why build your own images at all? I’m not sure I understood what advantage that gives you.
Harbor looks interesting but that install procedure is ridiculous. Why would I run an installer script just to pull docker images, just give me a compose file ffs. The only way I’d ever consider it is inside an LXC container or a VM.
Also, it sounds like they’ve never heard of a reverse proxy and don’t know you can do TLS that way? That does not inspire confidence.
Why build your own images at all?
Trust. A LOT of docker images are just some person who decided to do it first. Hopefully php has an official one though.
PHP does have a number of official ones, yes, but the way they are designed still makes it often more efficient to just download their Dockerfiles and use as a guide to make your own (I’ve had to do that in particular because of how difficult it is to install some specific PHP extensions on their Alpine image sets).
PHP hardened (distroless) images
That’s a good point, maybe I’ll change that at some point. The reason, haven’t done so yet is that I wanna have the whole supply chain under my control. And know exactly what has been changed since a release.
Why build your own images at all?
Because of different reasons:
- Flexibility: I can modify a container to my needs.
- Trust: I don’t wanna rely on something that I don’t have under control. An image might contain some breaking changes in the next version, and that could cause me problems when I apply them.
- Learning: By doing everything myself I learn about how to do it.