Canonical Expands Ubuntu Pro With Distroless Docker Image Service Offering 12-Year Support (betanews.com) 7
BrianFagioli writes: Canonical has introduced a new service enabling the creation of custom distroless Docker images under its "Everything LTS" program. This initiative allows customers to include any open-source software in their Docker images, regardless of whether it is packaged in Ubuntu, with a security maintenance commitment of up to 12 years. [...] This expansion of the Ubuntu Pro offering incorporates numerous new open-source components, especially current AI/ML tools, maintained directly from the source rather than as traditional 'deb' packages. This approach aims to minimize the attack surface of containers, thereby enhancing security and aiding compliance with various regulatory standards such as FIPS, FedRAMP, EU Cyber Resilience Act, FCC U.S. Cyber Trust Mark, and DISA-STIG.
Doesn't seem credible... (Score:3)
They are announcing a commitment to provide 12 years of support to *any* software the customer might find anywhere made by anyone? That seems doubtful.
Even limiting it to "only problems where someone manages to get a CVE open" isn't exactly a way to avoid stupid work, MITRE has been granting CVEs for some pretty silly stuff, some of which never actually get addressed by the target project because they dispute the validity of the CVE, but the submitter has more time to keep the CVE alive than random open source project has to formally dispute it.
Or the project may be abandoned, or a big rewrite caused them to no longer consider it their problem because they don't support old editions.
All this adds up to Canonical promising to potentially write arbitrary code for any arbitrary project... Doesn't seem to be a credible promise...
Re: (Score:2)
"Everything LTS means CVE maintenance for your entire open source dependency tree"
That's not a sustainable business model based on current one-off pricing.
And they can do arithmetic.
So ... most likely it's a play to get entire enterprises to drop IBM and come over to Ubuntu.
Then the loss-leader on this offer makes sense. And the offer may not go on forever.
Re: (Score:2)
FTFA: "Customers engaging with Canonical can request the design of a Docker image for a specific open-source application..."
That sounds like you pay them for some professional services to create the initial image, and then they support it as part of your subscription. I doubt they will support random stuff you install on your own.
FIPS (Score:2)
Exactly when do we get current FIPS on modern Ubuntu?
Re: (Score:2)
If the people running the Gaza operation are stuck dealing with RPM's, there may be a lack of motivation to change that.
Literally, "ubuntu".
It means something.
Re: (Score:2)
Still waiting on the work of others so that I can meet last year's standards... I am willing and do pay.
Will docker be alive in 12 years? (Score:2)
So you're going to (supposedly) have an instance of Ubuntu running in Donker container.. in 12 years...
What OS is the container running in?
Ubuntu Zealous Zingbat?
Somebody should read the "article"... erm... marketing brochure.