Skip to content

Recommendations related to used images, given by LSP are less than desirable #122

Open
@kpostekk

Description

@kpostekk

While dockerizing one of my nodejs application I have occured on following recommendation

Image

In my opinion, this recommendation is not helpful, and may confuse new users of Docker.
First two recommendations are totally incorrect, because I have selected Node 24 for a reason, and it's better to pin to selected version of OS.
Last one is absolute bogus, because compared to selected image is based on different OS, does not pin version, and generally is incompatible with existing setup for Alpine based images (also as plugin has mentioned, slim tag has a lot of more vulnerabilities).

In my opinion there is no real reason to give recommendations to images that are relatively new, do not have any know vulnerabilities. Recommending a different base OS for these kind of image is bad idea too.

Making recommendations based of base layer of image can be a good idea. Scanning for simple "apt" or "apk" Dockerfile can help with decting incompatibilites between tags.

Related #101

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions