One reason is that software isn't always distributed in normal distro repositories anymore. People can't (or don't want to) deal with dependency management so they ship an entire (slightly outdated version of an) OS with their application to make deployment foolproof.
The vaultwarden install instructions assume Docker, for example: https://github.com/dani-garcia/vaultwarden. If you want to install native binaries, you're going to have to git fetch/checkout/pull the latest release tag and run `cargo build --features sqlite --release` yourself. Doable in a cronjob, but it'll probably take a compile to build a system like vaultwarden on a low-power ARM core.
Yes, Docker is a black box. You don't know anything, you just launch something without understanding what components it consists of, what are they doing individually, what is their attack surface.
Not to mention that it encourages sloppiness and software bloat. The password manager could be put on a simple MCU device, instead, we have a large non-transparent multi-component installation swept under the rug with Docker. I do not think this is a good thing.
The same can be said of any software that you don't review and compile yourself. Whether I run a Docker container or pull in 500 npm/pip/cargo/gems/composer dependencies, the attack service remains. With Docker these individual layers can be separated and inspected at the very least.
Based on the name, I expected someone to take vaultwarden and make it an αcτµαlly pδrταblε εxεcµταblε that runs on its own without an OS; instead, this is just a quick tutorial for "how to set up vaultwarden".
Comments
One reason is that software isn't always distributed in normal distro repositories anymore. People can't (or don't want to) deal with dependency management so they ship an entire (slightly outdated version of an) OS with their application to make deployment foolproof.
The vaultwarden install instructions assume Docker, for example: https://github.com/dani-garcia/vaultwarden. If you want to install native binaries, you're going to have to git fetch/checkout/pull the latest release tag and run `cargo build --features sqlite --release` yourself. Doable in a cronjob, but it'll probably take a compile to build a system like vaultwarden on a low-power ARM core.
Yes, Docker is a black box. You don't know anything, you just launch something without understanding what components it consists of, what are they doing individually, what is their attack surface.
Not to mention that it encourages sloppiness and software bloat. The password manager could be put on a simple MCU device, instead, we have a large non-transparent multi-component installation swept under the rug with Docker. I do not think this is a good thing.
The same can be said of any software that you don't review and compile yourself. Whether I run a Docker container or pull in 500 npm/pip/cargo/gems/composer dependencies, the attack service remains. With Docker these individual layers can be separated and inspected at the very least.
Based on the name, I expected someone to take vaultwarden and make it an αcτµαlly pδrταblε εxεcµταblε that runs on its own without an OS; instead, this is just a quick tutorial for "how to set up vaultwarden".