|
|
@@ -187,6 +187,44 @@ Please read [our blog post](
|
|
|
http://blog.docker.io/2014/01/docker-code-contributions-require-developer-certificate-of-origin/)
|
|
|
on the introduction of the DCO.
|
|
|
|
|
|
+### When building an image, should I prefer system libraries or bundled ones?
|
|
|
+
|
|
|
+*This is a summary of a discussion on the [docker-dev mailing list](
|
|
|
+https://groups.google.com/forum/#!topic/docker-dev/L2RBSPDu1L0).*
|
|
|
+
|
|
|
+Virtually all programs depend on third-party libraries. Most frequently,
|
|
|
+they will use dynamic linking and some kind of package dependency, so
|
|
|
+that when multiple programs need the same library, it is installed only once.
|
|
|
+
|
|
|
+Some programs, however, will bundle their third-party libraries, because
|
|
|
+they rely on very specific versions of those libraries. For instance,
|
|
|
+Node.js bundles OpenSSL; MongoDB bundles V8 and Boost (among others).
|
|
|
+
|
|
|
+When creating a Docker image, is it better to use the bundled libraries,
|
|
|
+or should you build those programs so that they use the default system
|
|
|
+libraries instead?
|
|
|
+
|
|
|
+The key point about system libraries is not about saving disk or memory
|
|
|
+space. It is about security. All major distributions handle security
|
|
|
+seriously, by having dedicated security teams, following up closely
|
|
|
+with published vulnerabilities, and disclosing advisories themselves.
|
|
|
+(Look at the [Debian Security Information](https://www.debian.org/security/)
|
|
|
+for an example of those procedures.) Upstream developers, however,
|
|
|
+do not always implement similar practices.
|
|
|
+
|
|
|
+Before setting up a Docker image to compile a program from source,
|
|
|
+if you want to use bundled libraries, you should check if the upstream
|
|
|
+authors provide a convenient way to announce security vulnerabilities,
|
|
|
+and if they update their bundled libraries in a timely manner. If they
|
|
|
+don't, you are exposing yourself (and the users of your image) to
|
|
|
+security vulnerabilities.
|
|
|
+
|
|
|
+Likewise, before using packages built by others, you should check if the
|
|
|
+channels providing those packages implement similar security best practices.
|
|
|
+Downloading and installing an "all-in-one" .deb or .rpm sounds great at first,
|
|
|
+except if you have no way to figure out that it contains a copy of the
|
|
|
+OpenSSL library vulnerable to the [Heartbleed](http://heartbleed.com/) bug.
|
|
|
+
|
|
|
### Can I help by adding some questions and answers?
|
|
|
|
|
|
Definitely! You can fork [the repo](https://github.com/dotcloud/docker) and
|
Jérôme Petazzoni