Alpine does well at making security measures like SELinux accessible. Meta-distributions like Debian serve a different purpose.
OpenBSD has more than a great track record on security, maintainability, community spirit. As has Debian.
Alpine, after ten years, was simply not on the radar as a distro.
It is merely developers that do not seem to care about the actual systems these containers are built from that find Alpine interesting.
It's small, so even on a 3g connection you can download those containers and get the functionality a developer seeks. Fast. And that is fine. It gets alpha code out in a timely manner without too many resources.
Just do not pretend that this way of working will deliver sustainable, maintainable and consistent code that will work just as well inside as well as outside containers.
Maintained, secure, stable and proven distributions have served any purpose given in the past. From embedded systems to HPCs, from trading floors to satellites.
Saying any of the "old school" distro's are a bad fit for running in a container is a display of ignorance at best.
GP also goes into some detail about the amount of discussion and updates to Alpine Linux, which are excellent metrics for code quality.
Code quality has nothing to do with how much jibber-jabber there is on some mailing list, nor with how widely used a piece of code is. It has to do with the actual code.
In the case of Alpine Linux (which I've never used), probably 50% of the code is the linux kernel itself, another 20% is musl and busybox, and the rest is random gnu utilities. Which of those things is 'low quality' and has 'undiscovered bugs and security vulnerabilities' that broken, random, low-quality high-politics tire fires like most linux distributions don't have?
But conversely, is it not intrinsically obvious that not having the grotesque pile of random freshman desktop apps and terrible init systems that other distros have, could reduce the attack surface to a point where a single organization could conceivably make sense of it?
Furthermore, the problem I have with Alpine-based containers is that using those as the basis of tooling used for building your own product, your own product will have a hard time becoming maintainable, sustainable an secure.
I've had developers doing make; make install in Dockerfiles just because Alpine doesn't have some library or version packaged.
Containerization brings all manner of sweetness to the table, but the current way it is used is a throwback to 1998.
Not having desktop software inside a small container does reduce the attack surface. Debian, Ubuntu, Centos can handle that requirement just fine. What is your point?
While you're at it, please show me the Debian, Ubuntu, or CentOS distribution that doesn't have desktop bus installed. I'll wait.
> why are you trying to create FUD about how Alpine Linux is unmaintainable, unsustainable, and insecure?
I never tried to make that claim.
What I am trying to say is that if YOU built YOUR software against Alpine, IT will be hard to maintain/sustain/insecure. Because your software will probably have dependencies. Dependencies not found in Alpine. And now you have to maintain and test those dependencies. You'll have to keep informed on all the security advisories of those dependencies. All the changelogs. And by then, you've started to reinvent wheels that the fine folks of Debian, Ubuntu, Centos have invented already.
That is a resource drain on companies that is inefficient and cumbersome with little to no added value.
> While you're at it, please show me the Debian, Ubuntu, or CentOS distribution that doesn't have desktop bus installed.
A container is not the same beast as a distribution. It does not have the same requirements. It is just a tarball. And you can throw anything into it, or out of it.
I'm just saying to use debootstrap to throw stuff in that tarball so you have the benefits of an enterprise-level, proven distribution, instead of using this something that has not yet proven itself. So if you ever need to take your software OUT of the container and run it on an AWS instance, or on your own hardware, you'll have no problem with it.
In short: I see no added value for Alpine. It does not address my operational concerns, and raises a bucketload of new ones when I compare it to Debian, Ubuntu or Centos.