The Curse of Docker

• watchtower

  215 17,110 8.2 Go

  A process for automating Docker container base image updates.

  

So i primarily use containers on my local machine walled off from the internet, so it's not a big concern for me. Watchtower [1] is popular among home server users too which automatically updates containers to the latest image.

For production uses I think companies generally build their own containers. They would have a common base linux container and build the other containers based off that with a typical CI/CD pipeline. So if glibc is patched, it's probably patched in the base container and the others are then rebuilt. You don't have to patch each container individually, just the base. Production also minimizes the scope of containers with nothing installed except what's necessary so they have few dependencies.

[1] https://github.com/containrrr/watchtower

• whats-up-docker

  14 819 3.4 JavaScript

  What's up Docker ( aka WUD ) gets you notified when a new version of your Docker Container is available.

We use What's Up Docker [1] to monitor for new versions of docker containers that are created by others (eg. self hosted apps).

For containers we create ourselves, we automatically rebuild them each night which pulls the latest security updates.

[1] https://github.com/fmartinou/whats-up-docker

• InfluxDB

  www.influxdata.com featured

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• wasmer

  131 17,944 9.9 Rust

  🚀 The leading Wasm Runtime supporting WASIX, WASI and Emscripten

  

It's funny how WebAssembly can help overcome most of the issues mentioned on the blogpost (packaging, configuration, portability) if addressed properly.

That's the main reason Wasmer [1] was created :)

[1] https://wasmer.io

• sourcegraph

  69 9,764 10.0 Go

  Code AI platform with Code Search & Cody

  

While a readable Dockerfile can work as documentation, there are a few caveats:

* the application needs to be designed to work outside containers (so, no hardcoded URLs, ports, or paths). Also, not directly related to containers, but it's nice if it can be easily compiled in most environments and not just on the base image.

* I still need a way to notify me of updates; if the Dockerfile just wgets a binary, this doesn't help me.

* The Dockerfiles need to be easy to find. Sourcegraph's don't seem to be referenced from the documentation, I had to look through their Github repos to find https://github.com/sourcegraph/sourcegraph/tree/main/docker-... (though most are bazel scripts instead of Dockerfiles, but serve the same purpose)

Suggest a related project