On 6/24/22 23:39, Daniel Morris wrote:
On Fri, Jun 24, 2022 at 12:12:07PM +0200, Richard Brown wrote:
On Fri, 2022-06-24 at 11:15 +0200, Eric Schirra wrote:
What always amazes me. They want to introduce things like ALP (that's the docker story, isn't it?),
Docker? Not likely, the current thinking of the Local Container Management WG is that Podman will be the default container runtime for local workloads - with containerd/whatever-is-wanted-by-kubernetes being the non-local, clustered container runtime of choice.
Will the containers be shipped/built with an SBoM (Software Bill Of Materials) from the outset? Lots of organisations are trying to retro-fit or retro-generate SBoMs to help with vulnerability management, compliance etc., it would seem good to bake SBoMs in from the start.
A base image with a plethora of container images, from numerous sources is going to ramp-up the management workload to track/react-to potentially vulnerable packages.
Well from an openSUSE perspective if the base for the vast majority of these packages (atleast for container images we ship) was built from openSUSE / SLE RPM's then this effort might not be significantly more then what we currently do other then things like multiple python versions which will be significantly easier to pull off by having people either use say a python3.8 or python3.10 container environment then it would be to do currently in Leap. -- Simon Lees (Simotek) http://simotek.net Emergency Update Team keybase.io/simotek SUSE Linux Adelaide Australia, UTC+10:30 GPG Fingerprint: 5B87 DB9D 88DC F606 E489 CEC5 0922 C246 02F0 014B