3 ms·

I think the Alpine Linux image for Docker is a good solution to the point about userland bloat. Much better than unikernels, which would entail giving up all th

I think the Alpine Linux image for Docker is a good solution to the point about userland bloat. Much better than unikernels, which would entail giving up all the benefits of running containers on a shared, mature OS kernel, particularly with regard to performance, resource pooling, and debuggability. I'm still waiting for bcantrill, who actually has experience with large-scale production systems (unlike me), to expound on why he believes unikernels are a terrible idea, as he said in a brief rant here: https://www.youtube.com/watch?v=Ya6h2zKlpaQ&t=5110 https://www.youtube.com/watch?v=Ya6h2zKlpaQ&t=5110

shykes 11y ago
Personally I love both: minimal, secure-oriented distros like Alpine Linux, and unikernels. They will both play an important in building robust, scalable distributed systems.
simonvdv 11y ago
Even though using Alpine as the base image for a container is a lot beter/cleaner than other base image imho we shouldn't rely on distro package management inside containers. Not only does running a package manager inside the container mean you'll need to satisfy its dependencies in your image you also increase the image's attack surface compared to an image without a package manager. Ideally we'd have a simple way of installing stuff into images from the outside so you can always start `FROM scratch` and add the minimum deps you need to run your app. Adding stuff could be as simple as extracting tars with the tar's contents following the Filesystem Hierarchy Standard. Each tar could be a layer so it matches well with how Docker images work as well. Since it isn't possible to extend the Dockerfile syntax I started prototyping a static binary written in Go to add to `scratch` to do this. It worked better than I expected :) Only thing I couldn't find was a distro that packaged it's packages this way and it would obviously suck to create another packaging standard.

shykes 11y ago

Personally I love both: minimal, secure-oriented distros like Alpine Linux, and unikernels. They will both play an important in building robust, scalable distributed systems.

simonvdv 11y ago

Even though using Alpine as the base image for a container is a lot beter/cleaner than other base image imho we shouldn't rely on distro package management inside containers. Not only does running a package manager inside the container mean you'll need to satisfy its dependencies in your image you also increase the image's attack surface compared to an image without a package manager. Ideally we'd have a simple way of installing stuff into images from the outside so you can always start `FROM scratch` and add the minimum deps you need to run your app. Adding stuff could be as simple as extracting tars with the tar's contents following the Filesystem Hierarchy Standard. Each tar could be a layer so it matches well with how Docker images work as well. Since it isn't possible to extend the Dockerfile syntax I started prototyping a static binary written in Go to add to `scratch` to do this. It worked better than I expected :) Only thing I couldn't find was a distro that packaged it's packages this way and it would obviously suck to create another packaging standard.