Hello all, Happy to announce that we are out of the POC phase, and are gearing up towards implementing Metaflow for our first customer team. Reception has been overwhelmingly positive when we demo-ed the POC to some of our stakeholder. Everyone is very excited! We now have to work on some security non-negotiables and do our due diligence, which includes working with our internal Security team to review the infrastructure. Two items were raised: (1) Would you happen to know what are the underlying operating systems for the 2 dockerfiles being used for the ui and metadata service? Either we will need to move the contents of these dockerfiles into security hardened images or create some security exceptions. Looks like the ui is using alpine. (2) What is the cadence of these docker images being patched for security vulnerabilities? Are they frequently refreshed?

Hey @acoustic-van-30942 - that's great news!

metadata service is using Debian

Yes - thanks so much everyone! Couldn't have done it without all your help along the way.

The images are updated as and when security issues are brought to our attention in addition to regular feature additions that necessitate an update.

Okay perfect! The same image powers both the ui service and the metadata service? I was under the impression that they are distinct because they are in different repos: https://github.com/Netflix/metaflow-service/blob/master/Dockerfile https://github.com/Netflix/metaflow-ui/blob/master/Dockerfile

The

metaflow-ui

repository only contains the frontend. The backend for the

ui

is located here - https://github.com/Netflix/metaflow-service/tree/master/services/ui_backend_service

Yes the one created via the

computation

tf module

The docker image that powers the metaflow tasks are completely configurable. If you don't specify one we pick the

python:<py_ver>

image where

py_ver

corresponds to the version of Python used to launch the flow.

I think it's the AMI in the ec2 instance that's causing security alerts

it should be the default ECS_AL2 amazon linux one, exact version picked by AWS (its not pinned in the template)

Ok got it - I guess we can just modify this to using a security hardened AMI. That shouldn't be a problem

If you have blessed AMIs that you want to pin to - you should be able to specify those in your launch templates.

Perfect! Then that just leaves the dockerfiles. They're both using debian, right? • netflixoss/metaflow_metadata_service:v2.3.0 • public.ecr.aws/outerbounds/metaflow_ui:v1.1.2

no the first one is debian, second is alpine like you said

Got it. Thanks so much Oleg and Savin. Really appreciate the support!

Just ping us if you need any help. Also, happy to jump on a quick call if that's ever useful.

Much obliged! Will keep that in mind. 🙂