Lockdown your Dockerized build environments --- Because privileged mode is insecure, you should restrict your CI/CD environments to known users and projects. If this isn't feasible, then instead of using Docker, you could try using a standalone image builder like Buildah to eliminate the risk. Alternatively, configuring rootless Docker-in-Docker can mitigate some --- but not all --- of the security concerns... - Source: dev.to / 12 days ago

In my experience, not using docker to build docker images is a good idea. E.g. buildah[0] with chroot isolation can build images in a GitLab pipeline, where docker would fail. It can still use the same Dockerfile though. If you want to get rid of your Dockerfiles anyway, nix can also build docker images[1] with all the added benefits of nix (reproducibility, efficient building and caching, automatic layering,... - Source: Hacker News / 7 months ago

Buildah: This lightweight, open-source command-line tool for building and managing container images. It is an efficient alternative to Docker. With Buildah, you can build images in various ways, including using a Dockerfile, a podmanfile or by running commands in a container. Buildah is a flexible, secure and powerful tool for building container images. - Source: dev.to / 12 months ago

When I saw the title I thought it was going to be about `buildah` [1][2] Which allows you to create images using the command line to build them up step-by-step. [1] https://buildah.io/. - Source: Hacker News / over 1 year ago

Buildah is a "tool that facilitates building OCI images" of Containers. If it is not installed, podman system migrate will print out the warning:. - Source: dev.to / over 1 year ago

> So what we are missing now is a 500GB framework that can write the config file for the programming language that is writing a config file for the actual program I wish to use. That exists since 1960. It's called LISP. The e.g. https://guix.gnu.org/ uses with great success, the Guile Scheme dialect of LISP, to be precise. And FYI the "framework" is:

  $ ls --human-readable --size $(readlink $(which...

- Source: Hacker News / 4 months ago

> inventing a brand new purely functional language programming language. ISTM that if you dislike that, then there's GUIX. https://guix.gnu.org/ Very briefly, AFAICT, it's "Nix but using Scheme". - Source: Hacker News / 5 months ago

And just wait till you discover Arch Linux, Gentoo, Guix, or NixOS. Source: 11 months ago

Https://guix.gnu.org for example. It did load before an update but it doesn't anymore. Source: 12 months ago

Is it? Seems to me it's used for some pretty cool stuff, heard of Guix? Source: 12 months ago