Message-ID: <42ae97cb-f16a-4eeb-a519-d40de33bb631@schafweide.org>
Date: Thu, 19 Sep 2024 21:35:53 +0200
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: Discussion - Is Alpine Linux still a more secure Linux
 Distribution compared to its compatriots
To: ~alpine/users@lists.alpinelinux.org
References: <O74GIpz--B-9@tuta.io> <D4ACWC7305LF.2DM29SENIP4GF@riseup.net>
 <CAH8yC8nshCNg5S0PqbndjDvLjow5wSi3BmTwDnv0yrg8bZGJ1w@mail.gmail.com>
Content-Language: de-DE, en-US
From: Bjoern Franke <bjo@schafweide.org>
In-Reply-To: <CAH8yC8nshCNg5S0PqbndjDvLjow5wSi3BmTwDnv0yrg8bZGJ1w@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

Hi,

> One datapoint from my $dayjob... Alpine is used for container
> instances because it has a small footprint, and it is best-in-class
> with respect to vulnerability scanner results. I.e., it has the fewest
> findings from known exploits. This is compared with other popular
> distros like Debian and Ubuntu.
> 

I'm surprised that this aspect wasn't mentioned earlier. Some time ago 
at $dayjob we compared the Nextcloud Docker images, the Debian based one 
and the Alpine based one, with trivy. I don't recall the numbers in 
detail any more, but while trivy found dozens of vulnerabilities in the 
Debian image, there were nearly 0 in the Alpine image. Several 
vulnerabilities didn't even have Debian Security Advisories assigned.

Regards
Bjoern