How did we end up with containers?
This is mostly a good post, but he doesn’t mention one huge security <i>disadvantage</i> of containers: When application artifacts all include their own versions of dependencies locked at build time, it becomes very hard to update a component that has a security fix. It’s somewhat tractable if you own all the images — you “just” have to rebuild every application with the vulnerable component. But once you start accepting prebuilt images from elsewhere, you are at the mercy of the external source unless you want to fork the Dockerfiles.<p>It’s the same lesson that a lot of people learned about static linking, with the zlib vulnerabilities years ago.<p><a href="https:&#x2F;&#x2F;www.linux.com&#x2F;news&#x2F;linux-kernel-netscape-affected-major-zlib-security-vulnerability" rel="nofollow">https:&#x2F;&#x2F;www.linux.com&#x2F;news&#x2F;linux-kernel-netscape-affected-ma...</a>