<story><title>Musl 1.2.4 adds TCP DNS fallback</title><url>https://www.openwall.com/lists/musl/2023/05/02/1</url></story><parent_chain><item><author>robinhoodexe</author><text>We’re currently consolidating all container images to run on Debian-slim instead of a mixture of Debian, Ubuntu and alpine. Sure, alpine is small, but with 70% of our 500 container images being used for Python, R or node the final image is so large (due to libraries&amp;#x2F;packages), that the difference between alpine (~30 MB) and debian-slim (~80) is negligible. We’ve been experiencing the weird DNS behaviour of alpine and other issues with musl as well. Debian is rock solid and upgrading to bookworm from bullseye and even buster in many cases didn’t cause any problems at all.&lt;p&gt;I will admit though, that Debian-slim still has some non-essential stuff that usually isn’t needed at runtime, a shell is still neat for debugging or local development. This trade off could be considered a security risk, but it’s rather simple to restrict other stuff at runtime (such as run as non-privileged, non-root user with all capabilities dropped and a read-only file system except for &amp;#x2F;tmp).&lt;p&gt;It’s a balancing act between ease-of-use and security. I don’t think I’d get popular with the developers by forcing them to use “FROM scratch” and let them figure out exactly what their application needs at runtime and what stuff to copy over from a previous build stage.</text></item></parent_chain><comment><author>kelvie</author><text>My biggest beef with the apt&amp;#x2F;deb-based distros for container images is that apt-get updates installs take frustratingly long, whereas apks always tend to be near instant. I wonder what it is in the postinst and related scripts that just take so long and can&amp;#x27;t be parallelized!&lt;p&gt;Most of the reason I switched from Ubuntu -&amp;gt; Arch is that working with alpine allowed me to realize that installing packages and their dependencies don&amp;#x27;t have to take so long.</text></comment>
<story><title>Musl 1.2.4 adds TCP DNS fallback</title><url>https://www.openwall.com/lists/musl/2023/05/02/1</url></story><parent_chain><item><author>robinhoodexe</author><text>We’re currently consolidating all container images to run on Debian-slim instead of a mixture of Debian, Ubuntu and alpine. Sure, alpine is small, but with 70% of our 500 container images being used for Python, R or node the final image is so large (due to libraries&amp;#x2F;packages), that the difference between alpine (~30 MB) and debian-slim (~80) is negligible. We’ve been experiencing the weird DNS behaviour of alpine and other issues with musl as well. Debian is rock solid and upgrading to bookworm from bullseye and even buster in many cases didn’t cause any problems at all.&lt;p&gt;I will admit though, that Debian-slim still has some non-essential stuff that usually isn’t needed at runtime, a shell is still neat for debugging or local development. This trade off could be considered a security risk, but it’s rather simple to restrict other stuff at runtime (such as run as non-privileged, non-root user with all capabilities dropped and a read-only file system except for &amp;#x2F;tmp).&lt;p&gt;It’s a balancing act between ease-of-use and security. I don’t think I’d get popular with the developers by forcing them to use “FROM scratch” and let them figure out exactly what their application needs at runtime and what stuff to copy over from a previous build stage.</text></item></parent_chain><comment><author>Rapzid</author><text>This here. Honestly most orgs with uhh.. Let&amp;#x27;s say a more mature sense of ROI tradeoffs were doing this from pretty much the very beginning.&lt;p&gt;Also, Ubuntu 22.04 is only 28.17MB compressed right now so it looks equiv to debian-slim. There are also these new image lines, I can&amp;#x27;t recall the funky name for them, that are even smaller.</text></comment>