The document discusses Alpine Linux, highlighting its small, simple, and secure attributes as a Docker image. Key components include musl libc, busybox, and apk-tools, with a focus on security features such as position-independent executables and a hardened toolchain. It also outlines the scenarios in which Alpine Linux may not be suitable, particularly concerning dependencies on glibc or precompiled closed-source binaries.

1. Small, simple, and secure:
Alpine Linux
under the
microscope
Natanael Copa
Docker
Twitter: @n_copa

2. Small
Simple
Secure

3. Docker image size

4. Core Components
● musl libc
● busybox
● apk-tools
● toolchain

5. musl libc

6. musl libc
● MIT license
● Clean, modern codebase
● Correct in corner-cases
● Lightweight

7. What is missing?
● Some GNU extensions
● Lots of Localization
data
● Lots of GNU bloat
● Name Service Switch
(NSS)
● Network Services
Library (libnsl)
● 80+ CVEs
musl libc

8. busybox

9. busybox
● ~800 kb
● Includes most of POSIX’s shell &
utilities
● Corresponds to GNU coreutils,
iproute2, grep, sed, awk,
utils-linux, findutils, procps,
wget...
Bash alone is 668 kb
(1280kb inclusive readline
and ncurses)

10. Busybox tools
[ [[ acpid add-shell addgroup adduser adjtimex arp arping ash awk base64 basename bbconfig beep blkdiscard blkid blockdev brctl bunzip2bzcat
bzip2cal cat chgrp chmod chown chpasswd chroot chvt cksum clear cmp comm conspy cp cpio crond crontab cryptpw cut date dc dd deallocvt
delgroup deluser depmod df diff dirname dmesg dnsdomainname dos2unix du dumpkmap dumpleases echo ed egrep eject env ether-wake expand expr
factor fallocate false fatattr fbset fbsplash fdflush fdformat fdisk fgrep find findfs flock fold free fsck fstrim fsync fuser getopt getty grep groups gunzip gzip
halt hd hdparm head hexdump hostid hostname hwclock id ifconfig ifdown ifenslave ifup init inotifyd insmod install ionice iostat ip ipaddr ipcalc ipcrm ipcs
iplink ipneigh iproute iprule iptunnel kbd_mode kill killall killall5 klogd lesslink linux32 linux64 ln loadfont loadkmap logger login logread losetup ls
lsmod lsof lspci lsusb lzcat lzmalzop lzopcat makemime md5sum mdev mesg microcom mkdir mkdosfs mkfifo mkfs.vfat mknod mkpasswd mkswap
mktemp modinfo modprobe more mount mountpoint mpstat mv nameif nanddump nandwrite nbd-client nc netstat nice nl nmeter nohup nologin nproc
nsenter nslookupntpd od openvt partprobe passwd paste patchpgrep pidof ping ping6 pipe_progress pkill pmap poweroff powertop
printenv printf ps pscan pstree pwd pwdx raidautorun rdate rdev readahead readlink readprofile realpath reboot reformime remove-shell renice reset resize
rev rfkill rm rmdir rmmod route run-parts sed sendmail seq setconsole setfont setkeycodes setlogcons setpriv setserial setsid sh sha1sum sha256sum
sha3sum sha512sum showkey shred shuf slattach sleep smemcap sort split ssl_client stat strings stty su sum swapoff swapon switch_root sync sysctl syslogd
tac tail tar tee test time timeout top touch tr traceroute traceroute6 true truncate tty ttysize tunctl udhcpc udhcpc6 udhcpd umount uname unexpand uniq
unix2dos unlink unlzmaunlzop unshare unxzunzipuptime usleep uudecode uuencode vconfig vi vlock volname watch watchdog wc
wgetwhich whoami whois xargs xxd xzcat yes zcat

11. apk-tools

12. Demo
apt-get update -y &&
apt-get install -y python3 &&
python3 --version
apk add --no-cache python3 &&
python3 --version

13. apk-tools - what makes it fast
Traditionally package managers:
● read from network (1 read)
● save to local cache (1 write)
● verify signature (1 read)
● extract (1 read, 1 write)
Minimum 3 reads and 2 writes
Apk is designed to read once and
write once:
● checksum calculation while
waiting for I/O
● write directly to final
filesystem (as .apk-new)
● rename once signature is
verified
● delete .apk-new on signature
mismatch

14. Toolchain and security

15. Hardened toolchain
● link with relro, bind now (improves ASLR and PaX
memory protections)
● Position Independent Executables (PIE) - Even for
static binaries(!)
● Stack Smash Protector (-fstack-protector-strong)
● -DFORTIFY_SOURCE=2

16. Secure
● Use secure defaults
● Smaller attack surface
● Use more secure components (musl, libressl…)
● Hardened kernel (unofficial fork of grsecurity)

17. When to not use Alpine Linux
When you depend on
● precompiled closed source binaries (which
are linked against glibc)
● good localization
● commercial support
● glibc/GNU behavior

18. How to get involved
https://alpinelinux.org
https://wiki.alpinelinux.org
IRC Freenode #alpine-linux

19. Thanks!
Questions?