In turn the centralized OS authority needs proper maintenance otherwise it's just as bad if not worse, because of the larger blast radius
Apple fucked this up, but I really don't think the situation is "as bad if not worse" than if MacOS just didn't do this.
But this abstract exercise is only to highlight the importance of Apple getting its shit together, because such a scenario exists with Windows and the culture of downloading exes and msis and it's honestly way worse than having a central but responsible authority.
There’s very little actually running in a docker container. ca-certs may actually be an exceptional case though, since it’s not code that’s running but a kind of data.
It’s not like if you use an Ubuntu image for a node.js app that you get PHP too and have the PHP vulnerability present in your web app.
It's same problem we have when libraries get massive security vulnerabilities. Updating them is not always as easy as many would like.
This gets worse for each additional such layer, for example if you start from ubuntu:whatever and have a system deps layer, then an application deps layer, then static assets, then your app's code. Unless you think about it upfront when designing the pipeline, it can be challenging to trace all that state backwards and figure out how to safely re-build thing-from-x-weeks ago but with a single unsafe package bumped forward.
Every shop with competent devops people present should be set up for this, but it usually doesn't come for free.
That version of copy overlays the copied content without any knowledge of its underlay, so if the underlay changes, the hash of the layer created by COPY remains identical.
Obviously there are lots of situations this doesn't work for, but say you have a pool of Ubuntu packages (the system layer) and then you separately copy a CMake installspace or built uv project from a build stage, that project layer can be identical in hash if it's copied onto an updated system layer.
In practice, it's hard to get this to work because it's very easy in docker to accidentally trigger a rebuild for some random reason, but all the pieces are there.
> kubernetes
If only we could somehow share libraries and configuration files across apps rather than duplicating them and having to update them for every app individually.
We could call it a "shared library" system and an "operating" system. Someone should really invent this.
I mean, even docker could maybe use a shared base image or something right? ;-)
That's the world we live in now thanks to Google and Mozilla.
It's also worth remembering that both of these specific organizations were instrumental in major, positive security shifts that eventually hit OS's too, including shorter-lived certs, limiting the point of CAs, adoption of TLS 1.3, and likely other things. If anything, they deserve _more_ trust than the OS distributors on this specific front, perhaps also because they don't share the OS distributor's incentive to prioritize stability for paying customers, which can be at odds at times with harsh, prompt security measures.