[Question] Use Docker Hardened Images (DHI)

[stupidSheep]

Dear @JonasAlfredsson

Many thanks for this docker image! In December, Docker announced that their set set of hardened docker images for popular services becomes free for all, including images (debian, alpine) for nginx.

Would it be up for consideration to build your image on the DHI image(s) instead of the official nginx images?

I've not yet compared them - I figured I'd first ask whether you'd be interested in such an endeavour.
If so, I can compare the images and write up any difference I find (as far as it's in my ability) to make an informed decision.

This will most likely require a major release, since it will create multiple variants (e.g. a dev variant including common shell utilities and a production variant excluding many of them) and thus break images based on yours (since they expect certain shell commands to be available).

To give you an idea, here's is the list of preinstalled packages for the debian production image and here for the dev variant.

[JonasAlfredsson]

Hi stupidSheep,

Just taking a quick glance at the packages in the main container I see no Bash, which is the core of the scripts here, and installing that afterwards would probably return the number of installed packages close to the current official Nginx images.

There is also no source code available as of yet, so I have no idea how similar this container is to the official one (regardig configs etc.). What I strive for is for this image to be a drop-in replacement from the official Nginx (which is why we just use that as the base), which might be difficult if this hardened image has a different layout.

However, I have had thoughts of moving the parsing and updating code out to its own repo, in order to be able to import it into other projects, like the Freenginx and the YAML config case. It would then be possible to create a new repo for the hardened images, and then just import the parsing code, but there isn't really a strong desire for it as of now.

Furthermore, if this move is to be made I would probably look in to rewriting stuff in Python or Go instead, since the logic now is way too advanced for it to remain in Bash.

[stupidSheep]

Hi Jonas,

Thank you for your prompt reply. A drop-in replacement would likely have to be based on the -dev variant (even then layouts may differ). I've only found hackish solutions to get bash into a production image (getting it and its libraries from the -dev variant - alternatives I'm aware of are building from source or a static binary).

If you go ahead with your plans, I'd look into using it with a DHI image :)