http://coldfusion.com logo
Join Slack
Powered by
I'm using `ortussolutions/commandbox:lucee5-3.7.12...
# docker-commandbox
t
I'm using 
ortussolutions/commandbox:lucee5-3.7.12
for my server but when I run @foundeo's scan I get the following security issues. Are these issues addressed in newer images or are there any plans to fix them? Thanks!
b
That tag is from 8 months ago
We don't go back and "fix" docker images-- that sort of defeats how docker works
An image is set in stone and you just make a new one
I assume the latest images have whatever the latest JVM is.
t
Yeah, that's what I was wondering. Would the latest image solve this?
b
Regarding the user, that's debatable. Personally, I don't have an issue with using root in docker because docker is already a complete and total sandbox. It has access to only what you give it and the entire running container is literally just your single process.
This isn't 1978 in the days of a main frame with 1000 users, lol
That said, if you want to run the process as a non-root user, we do support that. Check the readme.
In reality though, there should be nothing in the container that the running process doesn't or shouldn't have access to, so what exactly are you trying to protect?
t
Yeah, agreed on the user role, I'd probably be inviting more problems fighting against how most Docker containers work.
b
The only reasonable purpose I've ever heard was IF your app had a vuln and IF that vuln allowed an attacker to obtain a remote shell and IF that remote shell allowed them to run any comands, they could run apt get. 🤷
👍 1
Open in Slack
PreviousNext
Powered by