11 ms·
Minideb – A small image based on Debian designed for use in containers
- jayrwren 9y agoI love minideb. It is a great compromise when you need glibc but would have otherwise used alpine.
- viraptor 9y agoCurious: what are the scenarios in which you needed glibc?
- davedunkin 9y agoNode.js packages with native code and .NET Core are a couple I’ve come across. Basically any C-based code prebuilt for generic Linix.
- nerdponx 9y agoBut couldn't you rebuild them yourself?
- jayrwren 9y agoGo code with C dependencies.
- geofft 9y agoNeat. Some overlap with https://github.com/GoogleCloudPlatform/distroless https://github.com/GoogleCloudPlatform/distroless ; I think one big difference is that Google's approach uses bazel to download and unpack .debs, and this one uses standard Debian tools (debootstrap). But the end result sounds similar.
- zwerdlds 9y agofor anyone else interested in the actual stats, I grifted this from their pr on the image: The minideb image currently weighs in at around 50MB uncompressed. For comparison the debian library image is 123MB, the alpine image is 5MB, and the newly released amazonlinuximage is 328MB.
- ridruejo 9y agoOnce you do anything interesting (i.e. install Python) then Alpine and minideb size are basically identical
- pebers 9y agoI guess it's a bit more specific than you meant it, but our standard Python image is ~20MB (alpine + python3, basically); that's still under half of minideb. Does look interesting for things that need glibc compatibility though. There are some packages to help with that in Alpine but they only go so far.
- raesene6 9y agoYep. I like alpine and use it for my images for preference, but some things like getting Ruby on Rails working with therubyracer can bascially hit a wall in alpine, so this could be pretty handy.
- SjuulJanssen 9y agoIn my experience python in alpine is is sometimes 2x slower. How does ruby perform under Alpine?
- ridruejo 9y agoThanks, this is where I got the data from: https://dzone.com/articles/minideb-a-minimalist-debian-based-docker-image https://dzone.com/articles/minideb-a-minimalist-debian-based...
- pebers 9y agoFrom looking at what I think is the Dockerfile for that image (https://github.com/docker-library/python/blob/b1512ead24c6b111506a8d4229134a29da240597/2.7/alpine3.6/Dockerfile https://github.com/docker-library/python/blob/b1512ead24c6b1...), that image is complex; it's downloading & building Python in it and adding & removing a dev toolchain, in a few different layers. I'm not surprised that I got something a lot smaller from just running `apk add python3.6`, although as a result they are not comparing apples to apples; their minideb example does pretty much exactly the equivalent (i.e. downloading the distro-provided package, not compiling it within their image).
- sintaxi 9y agoI use debian images for my infrastructure on VPS providers. Can anyone tell me what makes this "container specific"?
- amq 9y agoIf I run dozens of containers based on the same Debian image, would Minideb or even Alpine bring a big change, considering that Docker caches the layers?
- devonkim 9y agoThe point of smaller images to me isn't about disk savings as much as minimizing dependencies and surface area of attacks such as for glibc, bash, and OpenSSL in the past several years. Updating container images quickly is absolutely essential given the myriad of possible problems if they were to become stale. I suppose it wouldn't hurt to have smaller image layers when updating these containers more frequently to save on bandwidth at least.
- peterwwillis 9y agoReducing attack surface by only minimizing dependencies is a bit like putting your house on stilts.
- ridruejo 9y agoCan you elaborate why you think that is the case? This is a well-established security practice. I don't see much upside to having code or binaries around that are not needed but can be potentially exploited. One of the first things I did when I used to manage servers was shutdown and remove any services not needed, disable all Apache modules not in use, etc.
- peterwwillis 9y agoA house on stilts makes it difficult to rob, but not for the man who walks on stilts. Security practices need to be implemented holistically or they are easily defeated. By themselves they aren't worth much and end up being unnecessarily cumbersome. Removing outlying code that could be used as part of an attack can be useful for complex attacks. But they are essentially outliers - the actual code that you are actually running and is the actual target is still there, waiting to be pwnd. The time you spend trimming fat can often be better used to actually harden a system's access control or policies/procedures, perform auditing, etc.
- simplehuman 9y agoStarred, thanks. A little OT but how does bitnami make money? They don't seem to charge AMIs atleast. So, I guess they charge AWS/GCE for providing 1-click images? Or are they a consulting company (if so, why choose them over the original app authors)? Or both?
- ridruejo 9y agoBitnami co-founder here. Most of what we produce is open source and we aim to make money in ways that are useful to companies but not limit or handicap our offering and alienate people. For example, we offer optional backup and monitoring services through Bitnami Cloud Hosting (https://bitnami.com/cloud/hosting https://bitnami.com/cloud/hosting) and we also have commercial services for ISVs that want to package their commercial apps through our platform. We also provide support for infrastructure providers (i.e. cloud vendors) that want the applications integrated with their platforms in specific ways
- downrightmike 9y agoPicking up where Damn Small Linux left off. http://www.damnsmalllinux.org/download.html http://www.damnsmalllinux.org/download.html
- ridruejo 9y agoThere's a bunch of them, especially around networking use cases. Alpine itself was a fork of another embedded Linux distro. One appeal of Minideb and a big reason why we developed it is that at the end of the day, it is still Debian and you have access to all the DEB packages out there, which tend to cover more ground and be more actively maintained than more niche Linux distros
- mst 9y agowiremine's question upthread as to how this compares to debian:stable-slim seems like it would benefit from an answer from you or another maintainer (assuming I correctly read the "we" in your comment)
- ridruejo 9y agoAs some other comment pointed out, we update it daily. When we started debian-slim was not an option for us, but it has caught in terms of size and features, so we will definitely take another look
- vmarquet 9y agoIn addition to the "minimalist" aspect, this image seems to offer better practices on a security level than official Debian images. From their README: "The images are built daily and have the security release enabled, so will contain any security updates released more than 24 hours ago." A recent analysis showed that the debian:latest image is "updated roughly every month" https://anchore.com/blog/look-often-docker-images-updated/ https://anchore.com/blog/look-often-docker-images-updated/
- viraptor 9y agoI couldn't find anything in the post that correlates the Debian updates with security notices (which is your main point). If a security advisory comes out every 2-5 weeks and Debian updates on the same schedule, then I don't see a problem. But the data is just not there. (These have to be advisories actually affecting the image, not all of them)
- zenlikethat 9y ago> In addition to the "minimalist" aspect, this image seems to offer better practices on a security level than official Debian images I'm skeptical about this claim. Almost every image built from the Debian official image begins with `apt-get update` before you can actually install anything, which means you will almost always have the latest packages at the time of building.
- gramakri 9y agoapt update only updates the package list and not the packages themselves. So unless the docker file contains apt upgrade it still uses old packages.
- zenlikethat 9y agoThere's nothing to upgrade. Pretty much nothing is installed already in most base images. Even `ca-certificates` etc. have to be installed.
- thinbeige 9y agoSlightly OT: Which distribution (for being a Docker host) has the best unattended security updates incl. reboots? Requirements: - Quick to setup, best would be a one-liner and not something I have to google everytime - Update and reboot times can be slightly randomized, so the entire cluster won't go down
- CoreXtreme 9y agoIt just saves top 5-6MB over Debian slim version of images. It's not worth my time to use this instead of officially debian supplied images. Edit: I would like to know where exactly this 5-6MB is saved.
- kasabali 9y agoI guess removal of some essential packages
- edsiper2 9y agois there any big difference with the Debian image provided by Google ? launcher.gcr.io/google/debian8 (besides debian version)
- vietjtnguyen 9y agoI don't really work in this domain so maybe I'm missing something. If the goal is to essentially get the bare minimum needed to run a program into a Docker image why not develop your program in your desired environment and then use something like CDE [1] to copy (or obtain a list of) all the files touched in the desired invocation of the program. That copy or list can then be put into a tarball and imported with "docker import". Philip Guo even writes about this possible use [2]. Here's a silly example: cde python -c "import numpy as np; print(np.random.randn(3, 3).tolist())" pushd cde-package/cde-root/; tar cavf ../../cde-image.tar *; popd docker import cde-image.tar $USER:python-randn33 docker run $USER:python-randn33 python -c "import numpy as np; print(np.random.randn(3, 3).tolist())" docker run -t -i $USER:python-randn33 python If you look at the resulting "cde-image.tar" you'll find it to be quite bare. Mines had only 387 entries (files and folders). [1]: http://www.pgbovine.net/cde.html http://www.pgbovine.net/cde.html [2]: http://pgbovine.net/automatically-create-docker-images.htm http://pgbovine.net/automatically-create-docker-images.htm
- zenlikethat 9y agoProbably because syscall interception is not sufficient to create robust Linux program images. It will be an awkward moment if a stat, open, etc. that the program attempts in production doesn't work as expected because it wasn't run in development / bundling images. You'd have to execute every possible code path in the CDE bundling step to work properly.
- vietjtnguyen 9y agoSo it becomes a matter of whether or not you can achieve good coverage of your execution paths to account for all possible filesystem touches? Further invocations of "cde" with respect to the same "cde-package" folder will actually append to the "cde-root" file system copy so if you could manage to canvas your program's execution paths then the resulting file tree copy should be sufficient?
- rkangel 9y agoYou're right it is a question of coverage of execution paths, but that's a non-trivial problem. Have a look at the lengths that AFL uses to get even close: http://lcamtuf.coredump.cx/afl/ http://lcamtuf.coredump.cx/afl/ [tl;dr it intruments execution while using a genetic algorithm to mutate inputs optimising for code coverage] Statically determining dependencies is a lot easier and a lot more reliable! Particularly as you only need the base image once, and any extras on top are another layer on the Docker FS.
- tokenizerrr 9y agoOff topic but what software is everyone using for their registry with ACLs and pruning old images?
- wolfgang42 9y agoGitLab Container Registry. It integrates beautifully with the rest of GitLab, including the permissions and CI system. I believe it also has special support for Kubernetes though I've not tried using that.
- luord 9y agoThis is great, I created my own base images (for python and js, mostly) using debian as base; this shall be the new base.
- SwellJoe 9y agoThis seems smarter than some of the container OS approaches that start from distros that have weak or no package management, and rely entirely on the "container" model to provide updates and some combination of spit and duct tape to build them. There's a smallish Fedora for containers (exists in the Docker registry) as well; it's about 70MB, which is still a little beefy. Anybody know how big minideb is? Edit: zwerdids posted that it's ~50MB so a wee bit smaller than the currently commonly used Fedora container image. And an order of magnitude bigger than an Alpine image.
- angrygoat 9y agoThe `install_packages` command looks like a big win compared to the rather spammy form most Dockerfiles use now to install packages, e.g: $ install_packages mime-support vs: $ apt-get update && apt-get install -y --no-install-recommends mime-support && \ apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* That's a great win in itself, this is excellent.