EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Lobsters·Sep 7·5 min read
Hardening Container Images
TL;DR
A hardened container image for PowerDNS Recursor was created by compiling it statically in Alpine Linux, reducing the image size to 36MB. This approach minimizes unnecessary exposure and enhances security by eliminating shell access for potential attackers.
✦ Why It Matters
Consider hardening your container images today to enhance security and reduce vulnerabilities.
Key Takeaways
- Use static compilation to reduce container size.
- Implement Landlock to restrict filesystem and network access.
- Create a seccomp allowlist to limit system calls.
- Set up CI for daily image rebuilds with updated dependencies.
How It Works
The hardened image was built by statically compiling PowerDNS Recursor in an Alpine container, then copying the executables to a scratch image. This approach minimizes the attack surface by excluding unnecessary dependencies and features.
Security is further enhanced by using Landlock to sandbox access and a seccomp allowlist to restrict system calls, making it difficult for potential attackers to exploit the container.