[FEAT] Use Docker Hardened Images

[k3nsei]

Is this a new feature request?

• I have searched the existing issues

Wanted change

As Docker Hardened Images are now available to be used for free. I don’t see no reason to not use them as base. I would like for base image to be from dhi.io

https://www.docker.com/blog/docker-hardened-images-for-every-developer/

Reason for change

More secure images without known vulnerabilities.

Proposed code change

No response

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[thelamer]

This is an Alpine image, please explain your request you want us to make it a non Alpine image ?

[thespad]

There's basically no benefit when you're building FROM one of the DHI because you have to run them as root and include a package manager anyway - in any case our images are building Alpine from scratch, not just using an OOTB Alpine image.

[k3nsei]

@thelamer I would like it to be https://hub.docker.com/hardened-images/catalog/dhi/alpine-base

[thelamer]

So the "hardening" that occurs is just deleting files, I am simplifying it but it is literally just pulling the unused stuff, in the case of glibc you are distroless, the goal being just put the binaries and supporting shared libraries that are needed.

We do not base from Alpine, we ingest a tarball build a root and copy into scratch just like a hardened image would be built.

So your real request is remove stuff from this baseimage as we already have a a rootless path (though it is only on specific images and does not get as much attention as everything else).

So please explain what would you remove ?

[k3nsei]

I think there is more into that, but ideologically. Those images are managed on daily basis to get rid of all know vulnerabilities as fast as possible. Normal docker images normally have tens of them, and it is different with Alpine as it's starting as barebones distro. But it easier to sleep at night when you know that base image is taking security seriously.

[thelamer]

Yeah that is fine but we are trying to explain to you that you are asking for a refactor of our entire image fleet, we don't FROM alpine we build our own images and downstream images.
There is no line to swap and what we add in base we add because we need it, the Alpine image is as lean as it is because it is basically only busybox.

This is all we add:
https://github.com/linuxserver/docker-baseimage-alpine/blob/3.22/Dockerfile#L74-L85

[k3nsei]

Feel free to ignore this feature request if it doesn’t make sense in this context. It’s more about spreading the word that more secure containers are now available for free to everyone. And security always important especially when we run something in our private servers with lots of other important data there like NAS. Thanks for you time and have a nice weekend guy's 🍻

[thelamer]

The purpose of my responses was not to be right, it was to motivate a coherent plan or some kind of participation.
There is value in hardening docker images, but we are locked into how we do things mostly because it is how we always did it and we have a large install base.

The actual task is first going downstream in the images we produce and testing rootless mode and making non obstructive init changes (if blocks guarded by some kind of rootless detection) and getting that into the repos. Step 2 would be mapping the required binaries and libs for all the binaries used by that app and pruning all the files that are not linked (keeping in mind helpers like python and such that may be used for plugins etc). Those are the two steps to get to a hardened image and you have to do it without breaking existing users.

https://docs.linuxserver.io/misc/non-root/

It's slow and methodical, requiring man hours and project tracking due to the fleet size.