Container Vulnerability Management
How I manage my Containers and their Vulnerability Management across selfhosted infrastructure and how the patching of PHP2SHELL looked like
https://nheinz.eu/blog/2026/10/container-vulnerability-management/Open linkView original on infosec.pub
6 replies
You might be interested in: https://github.com/project-copacetic/copacetic
Thanks, seems interesting ...
Why not use PHP hardened (distroless) images as a base for the final image?
Why build your own images at all? I'm not sure I understood what advantage that gives you.
Harbor looks interesting but that install procedure is ridiculous. Why would I run an installer script just to pull docker images, just give me a compose file ffs. The only way I'd ever consider it is inside an LXC container or a VM.
Also, it sounds like they've never heard of a reverse proxy and don't know you can do TLS that way? That does not inspire confidence.
Trust. A LOT of docker images are just some person who decided to do it first. Hopefully php has an official one though.
PHP does have a number of official ones, yes, but the way they are designed still makes it often more efficient to just download their Dockerfiles and use as a guide to make your own (I've had to do that in particular because of how difficult it is to install some specific PHP extensions on their Alpine image sets).
That's a good point, maybe I'll change that at some point. The reason, haven't done so yet is that I wanna have the whole supply chain under my control. And know exactly what has been changed since a release.
Because of different reasons: