2026-05-06 00:20 UTC
@lightweight @JulianOliver @ggpsv One complaint on a quick skim is that you didn't say that using "FROM ubuntu:latest" was being done in order to give your example container the highest chance to break out :-) Down near the bottom of the page you discussed running a slim image because of course you know that "FROM scratch" is hardest and best. I think it probably should have been emphasised at the beginning :-)
Replies (1)
-
@ggpsv@social.coop 2026-05-06 02:50
@yojimbo @lightweight @JulianOliver That's a fair point! I figured starting with a broader base would help with the user namespace explanation, particularly because of all the users that are already built into the image. Also, from a teaching perspective, perhaps starting from ubuntu as a base might be more "accessible" to a newcomer's mental model of containers than jumping straight ahead to distroless/scratch. The exploit overview builds from the rootless/namespaces overview so I decided to stick with that for consistency. To your point, had the article focused solely on the hardening aspect, then yes, starting with a much smaller image would've been preferable.