Merge pull request #6796 from jpetazzo/bundled-vs-packaged

Add FAQ entry about bundled vs packaged libraries

docs/sources/faq.md

@@ -187,6 +187,44 @@ Please read [our blog post](
 http://blog.docker.io/2014/01/docker-code-contributions-require-developer-certificate-of-origin/)
 on the introduction of the DCO.
 
+### When building an image, should I prefer system libraries or bundled ones?
+
+*This is a summary of a discussion on the [docker-dev mailing list](
+https://groups.google.com/forum/#!topic/docker-dev/L2RBSPDu1L0).*
+
+Virtually all programs depend on third-party libraries. Most frequently,
+they will use dynamic linking and some kind of package dependency, so
+that when multiple programs need the same library, it is installed only once.
+
+Some programs, however, will bundle their third-party libraries, because
+they rely on very specific versions of those libraries. For instance,
+Node.js bundles OpenSSL; MongoDB bundles V8 and Boost (among others).
+
+When creating a Docker image, is it better to use the bundled libraries,
+or should you build those programs so that they use the default system
+libraries instead?
+
+The key point about system libraries is not about saving disk or memory
+space. It is about security. All major distributions handle security
+seriously, by having dedicated security teams, following up closely
+with published vulnerabilities, and disclosing advisories themselves.
+(Look at the [Debian Security Information](https://www.debian.org/security/)
+for an example of those procedures.) Upstream developers, however,
+do not always implement similar practices.
+
+Before setting up a Docker image to compile a program from source,
+if you want to use bundled libraries, you should check if the upstream
+authors provide a convenient way to announce security vulnerabilities,
+and if they update their bundled libraries in a timely manner. If they
+don't, you are exposing yourself (and the users of your image) to
+security vulnerabilities.
+
+Likewise, before using packages built by others, you should check if the
+channels providing those packages implement similar security best practices.
+Downloading and installing an "all-in-one" .deb or .rpm sounds great at first,
+except if you have no way to figure out that it contains a copy of the
+OpenSSL library vulnerable to the [Heartbleed](http://heartbleed.com/) bug.
+
 ### Can I help by adding some questions and answers?
 
 Definitely! You can fork [the repo](https://github.com/dotcloud/docker) and