5 ms·
A lot of people say you don't need Heroku when you have Docker images, but Heroku actually takes care of the vast majority of vulnerabilities for you.
by aboutruby 8y ago
A lot of people say you don't need Heroku when you have Docker images, but Heroku actually takes care of the vast majority of vulnerabilities for you.
- mikepurvis 8y agoThis has always been my hesitation with Docker— unless you have a proper pipeline in place to be constantly rebuilding your overlay from updated versions of the base image, you're basically just carrying a snapshot of unknown binaries into the future with you, indefinitely. Obviously, any reasonable shop will have such a pipeline in place, but DockerHub and the whole ecosystem of docker getting started tutorials seem to really encourage a "set it and forget it" mentality toward a container once it's built and working.
- orf 8y agoDo they? The whole point is you'd rebuild your app every redeploy, which includes from the base image. Docker has a lot of problems but build repeatability is not one of them, in my experience. It makes it really really frictionless, in some cases way too frictionless
- duxup 8y agoAs someone just getting a feel for Docker I keep thinking: "Wait what is all th---" And then the tutorials or documentation just rolls on.... and doesn't really get back to what I should be doing to maintain / secure anything.
- driverdan 8y agoYou're assuming a lot. Take a look through a popular buildpack source and you'll see how they work. They do version pinning which means someone has to be aware of a vuln, its patch, and update the buildpack. I'm not saying they don't do that, just that it still requires a person to make the necessary changes. It's not inherently more secure.