The worse thing is that all that gets statically linked into your final container image.
There used to be a time that when you had a very severe C library bug, all you needed to do was update it on your hosts, reboot, done. People in the '80s and '90s worked really hard to add dynamic linking, etcetera, to Unix. Precisely to enable this level of system management.
Now, we’re twenty years later and people actively promote containerized microservices which are exactly the sort of statically linked executables that were so hard to manage and prompted dynamic linking.
Now, you run your 50-microservice PaaS with a couple of thousand instances and the CVE lands on glibc - everybody has to rebuild and redeploy everything.
It’s beyond stupid, frankly, and I’m waiting for the day that Docker will sport “dynamic container linking”, so a perfectly fine wheel gets reinvented in the most horrendously complex way imaginable, because that’s how Sillicon Valley (where, alas, too much of our tooling gets built) rolls.
