Scratch containers and the supply chain trouble
summary
Claims that scratch containers eliminate OS-layer risk meet experiments: Go static binary images drop reported issues from 675 vulnerabilities (Debian base) to 8 vulnerabilities (binary), Alpine shows zero, but scanners like trivy fail to detect bundled Python dependencies when built with PyInstaller + Static X, yielding false zeros. The talk shows concrete builds, comparisons, SBOM and scanner behaviors, and demonstrates that static binaries reduce attack surface but can break SCA and give misleading scan results.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:27Scratch containers purpose
- 8:11Common base image problems
- 10:57Scratch for security
- 15:19Non-static binaries challenges
- 23:28Vulnerability scanner detection
- 28:03Binaries linking multiverse
- 36:41Scanner limits with scratch
- 40:00Security trade-offs
- 45:15Alternatives to scratch
- 46:18Key takeaways
- 47:01Q&A
related talks
06mWhy statically compiling and using SCRATCH are important (Kill The Cruft!)
40mSecuring Containers by Breaking in
29mFragile by Design: Large-Scale Evidence of Supply Chain Risk
40mPanel Discussion: Open Source Supply Chain Security - Are Containers..
20mHow Secure is Your Base Image? ...
35mDocker Security
35mSecuring Containers by Breaking In
24mOvercoming CVE Shock - Adding Perspective in Vulnerability Scanning