Ended up kicking Docker Hardened Images to the curb.
The good folks at #Docker decided to update their #Redis image to use a distro-less start (no shell, no other utilities) *without changing the image tag*.
So when I started up my #Mastodon server after an upgrade, my customization script wouldn’t run in the container and I had to scramble to find an alternative.
Basically, they broke the contract of immutable image version tags. Won’t trust them again, even if it did harden #security further.
So this server is back to a good ol’ upstream #PostgreSQL image on #AlpineLinux. And #Valkey on #Alpine, too, because Redis Ltd..’s software licensing shenanigans are sketchy.


