this post was submitted on 03 Feb 2024
605 points (95.5% liked)
linuxmemes
20703 readers
2270 users here now
I use Arch btw
Sister communities:
- LemmyMemes: Memes
- LemmyShitpost: Anything and everything goes.
- RISA: Star Trek memes and shitposts
Community rules
- Follow the site-wide rules and code of conduct
- Be civil
- Post Linux-related content
- No recent reposts
Please report posts and comments that break these rules!
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
If it’s an open-source project, usually the dockerfiles are available for reading.
Do you audit every line of code that you run in production? If you are trying some new python/django/sql app, are you reviewing all that?
I’d assume with a python based project, you’d be able to at least look at requirements and tell there’s something that sets off red flags. And you are either familiar/trust the maintainer, or you are reviewing the actual python itself?
Beyond that, the dockerfile is essentially just installation instructions for getting it running on a virgin system of X distribution. I wouldn’t call that a black box.
If the container isn’t part of an open source project, then this is a moot point then. The project itself is a black box.
You do you. Speaking for myself, I prefer to understand and be able to trivially inspect and modify the moving parts in the things I deploy so I have a snowball's chance in hell of debugging and fixing things when something inevitably goes wrong.
All I hear is FUD.
And all I see is someone taking this conversation way too personally.
You sound like someone who doesn’t want to save 10 minutes of work every day because it might cost you half an hour every month.