4 ms·
I ran into this while checking connectivity between containers on an internal Docker network where the image had neither curl nor wget. The main surprise was t
by mrshu 3mo ago
I ran into this while checking connectivity between containers on an internal Docker network where the image had neither curl nor wget.
The main surprise was that Bash has /dev/tcp which lets you do the equivalent of an HTTP request with a bit of shell magic, for instance:
exec 3<>/dev/tcp/service/8642
printf 'GET /health HTTP/1.1\r\nHost: service\r\nConnection: close\r\n\r\n' >&3
cat <&3
Where `service` is just the hostname of whatever you’re talking to and 8642 is the port you are trying to talk HTTP to.
Pretty cool!
- sevenzero 3mo agoIt seems pretty cool, but I am wondering if there's any drawback on just using images that support curl? I can't think of any and to me it's kinda a must have, even on production images
- giobox 3mo agoIt's also a two line Dockerfile to add wget or curl to almost any pre-existing container image. This is a fun idea though.
- monkpit 3mo agoYou might not have any say on what image is in use, for example, in a cicd library project.
- deleted 3mo ago[deleted]
- mrshu 3mo agoThat is indeed a solid pushback! :) For what its worth, this container used `python:3.12.2-slim-bookworm` and I really would not expect that sort of an image to bundle `curl` -- even if it is intended for production.
- TZubiri 3mo agoYou can also use the sockets lib in that case, you depend on POSIX instead of Linux
- sevenzero 3mo agoAh I see so it was basically a minimal image that bundles just python? I can see why it wouldn't bundle curl! Thought it was a custom Image for some reason, hence my original comment
- mrshu 3mo agoYes, a very minimal image indeed. Had it been a custom image, curl would be one of the first things I would make sure it contains :)
- figmert 3mo agoThis of course only supports http, not https. It's great for health checks e.g. in a docker environment. To do https, you'd have to use something like socat, but of course that doesn't use bash only.
- TZubiri 3mo agoHttps is almost always terminated separately from the application code.
- OptionOfT 3mo agoI always recommend to not have any dependencies outside of the code. So we start at compiling the codebase (Rust) against MUSL. That way we can run it with FROM scratch images. If we need more tooling available at runtime, then we look at alpine, but still using MUSL. If MUSL itself is proving problematic, or if some of the libraries we use need glibc then we can look at using some locked down image. The cool part about FROM scratch images is that you'll never have to update your base image to address CVEs. Only your software and its (compiled) dependencies.
- xmodem 3mo ago> The cool part about FROM scratch images is that you'll never have to update your base image to address CVEs. Only your software and its (compiled) dependencies. What's the benefit really, though? If you still need to be able to rapidly deploy a new image in response to a dependency CVE, what have you gained?
- regularfry 3mo agoYou've gained that happening much less frequently. The tradeoff is making every other problem harder to diagnose.
- NewJazz 3mo agoDebug containers are a thing. Add an ephemeral container to an already running pod, for example to add debugging utilities without restarting the pod. https://kubernetes.io/docs/reference/kubectl/generated/kubectl_debug/ https://kubernetes.io/docs/reference/kubectl/generated/kubec...
- xmodem 3mo agoYup! They are a good solution to the massive problem you caused for yourself by implementing a different "solution" to a non-problem. And even that's only true if you assume kubernetes is the only place your container runs where you might want to also debug it.
- xmodem 3mo agoMore than one ~500 employee company I've worked at has had security policies either encouraging or requiring the use of "distro-less" images - images with no OS components other than the absolute minimum required to run the application. For go binaries this meant literally nothing in the container apart from the executable. In theory it has a couple of benefits. You don't have to re-deploy your image to patch CVE's in OS components if you don't have any OS components. And it provides some measure of defence-in-depth - one could certainly theory-craft a scenario where an attacker gains some limited control over your application and then uses some OS component to escalate. These days if a security engineer is proposing my team adopt distro-less containers to receive these benefits, I would point out that we need to weigh them against the very real drawbacks of not having standard debugging tools available where and when we need them. And also to consider the relative impact of other defence-in-depth measures they could be pursuing instead - such as any sort of network policy to limit network traffic.
- NewJazz 3mo agoDebug containers are a thing. Add an ephemeral container to an already running pod, for example to add debugging utilities without restarting the pod. https://kubernetes.io/docs/reference/kubectl/generated/kubectl_debug/ https://kubernetes.io/docs/reference/kubectl/generated/kubec...
- fc417fc802 3mo ago> not having standard debugging tools available where and when we need them Keeping in mind that containers are merely a bunch of namespaces, there's nothing stopping you from entering the same PID namespace with a different mount namespace in order to debug.
- xmodem 3mo agoI am aware, thank you :). I responded to a sibling dupe-comment over here [1]. To summarize, in my experience there is immense value to having basic shell tools available in the environment where you need them with zero extra friction. Stripping those out provides a security benefit only in specific nebulous and niche scenarios. 1: https://news.ycombinator.com/item?id=48561605 https://news.ycombinator.com/item?id=48561605
- a012 3mo agoIt’s handy when you’re troubleshooting issue on a running container which you can’t just rebuild the image and reload