12 ms·

RFC: Ubuntu 18.04 LTS Minimal Images

280 points by pella 9y ago

pikchurn 9y ago
Posting here rather than the blog because I don't have a google account: What about adding sshd to the minimal install? If the purpose of this is minimal installs of containers and cloud servers and such, that seems like quite an omission.
- the8472 9y ago
  Container/VM management software may already provide a way to remote into them, so that would be redundant. Plus it's a minimal image, you can build your own intermediate one on top of that with SSH added.
  - sofaofthedamned 9y ago
    They don't necessarily give you a way of getting into the node, especially if it's in a broken state (which is the time i'd want to have a look) EDIT: I was wrong, this is made to be a container base, not for the nodes themselves (there is no init system)
- deleted 9y ago
  [deleted]
- acomar 9y ago
  This is supposed to run inside of a container. Why would you want sshd inside of a container?
  - sofaofthedamned 9y ago
    It isn't clear afaik. Maybe i'd like this as an alternative to CoreOS or whatever for my k8s nodes? EDIT: Good point, you're right, it has no init system etc and is meant to be used in a container. Point conceded :)
    - hosh 9y ago
      I wouldn't be surprised if Ubuntu started a project similar to Redhat Atomic (and now CoreOS/ContainerOS). On GKE, one advantage of using Ubuntu as the node OS is you can get access to Sysdig or OpenEBS.
      - sofaofthedamned 9y ago
        We've moved at work to mainly Alpine based k8s containers, which is awesome, but you lose a lot of debug ability. Thinking about it - with Linux KSM the overhead of full-fat containers based on Ubuntu (for example) isn't massive. We may have to look at the metrics I reckon.
      - dustinkirkland 9y ago
        You're looking for Ubuntu Core.
        hosh 9y ago
        Looking at Ubuntu Core, not sure it is doing the same kind of things that CoreOS ContainerOS, Google's ContainerOS, and Redhat Atomic is doing.
  - deleted 9y ago
    [deleted]
  - unethical_ban 9y ago
    Not arguing that point for this image, but I use containers as lightweight VMs, not only as stateless-horizontally-scalable-try-to-be-google app servers.
    - tomc1985 9y ago
      It's stupid that you've been downvoted. It is so tiresome to see people ask such useless questions like "what? you want to use this thing in some way that my tiny brain cannot envision? what is this madness?"
      - lox 9y ago
        His reply was snarky and created a false dichotomy. The 90% usecase exists in between “lightweight VM’s” and google scale horizontal app deployment. Consider that the former is just as much an outlier as the latter. This post is about a pragmatic minimal Ubuntu base image, which would meet neither case well.
        unethical_ban 9y ago
        It was snarky. But there is a dichotomy: It's either stateless or stateful. Either I'm supposed to SSH to it or I'm supposed to destroy and redeploy.
        lox 9y ago
        Again, consider that you are creating this dichotomy, not the tools, or vast majority of practitioners in this space. Docker comes with (and encourages) lots of ways to persist state, as do orchestration environments like Kubernetes and ECS and you should choose the approach that suits the problem you are solving. If you want containers as lightweight VM's, there are a ton of ways to do that and they are actively supported. I'm reluctant to get off-topic here, because the narrative relating to the actual post should be "Does it makes sense to have openssh in a minimal ubuntu base image", to which the answer is "No, obviously".
    - 9y ago
  - pikchurn 9y ago
    I use containers as lightweight VMs in many places. Generally I see this as a way to get a minimal install that other tools can then configure appropriately, with up to date packages fetched from upstream mirrors directly, instead of installed from CD and then upgraded. I currently use packer.io to script the creation of a bunch of server images, and for ubuntu I've missed the "minimal install CD" that other distros have. Instead packer has to download a 800MB CD image, in order to install only a few hundred megabytes of uncompressed packages in a bare-bones install, which is then provisioned using some orchestration tool that at its heart uses ssh to login to the virtual machine. Not having SSH means you need to add in some sort of serial-attach step to manually install sshd, or hook into the install scripts to download sshd as part of the install or whatever. Either way that's additional custom work that is probably common to a great many use cases.
    - isostatic 9y ago
      Just do a netboot with a preseed file (have your own local cache - either with apt-cacher or something more independent) Our server preseed has the following line d-i pkgsel/include string openssh-server build-essential iperf htop screen sysstat vim-nox And a couple of internal packages which have their own dependencies (including lldp, snmpd etc) which do a variety of things including user management (active directory based), automatic registration into our asset database and monitoring systems
    - moondev 9y ago
      This is meant as a base image for containers. There's not even a kernel or init
    - verst 9y ago
      So why not build your own version with a SSH daemon if you really need it? I don't think most people need the SSH daemon in their container image. Your Dockerfile could be something like this: FROM ubuntu:bionic RUN sudo apt-get install openssh-server -y && sudo service ssh restart These are definitely not the complete steps for setting up SSHd but you get the idea.
    - acomar 9y ago
- riffic 9y ago
  I don't want an sshd installed by default in my containers. What's your use case?
  - pikchurn 9y ago
    I'm not saying by default. I'm saying have it on the CD.
    - geofft 9y ago
      I often boot machines connected to the public internet or to a coffeeshop / other public wifi with the Ubuntu live CD, so I wouldn't like the live CD to have an sshd with a well-known password out-of-the-box. So if you're going to have to log into the machine to customize authentication anyway, you already have enough access to `apt-get install openssh-server`. (It would be nice to have a one-click tool that builds you a customized image with your own SSH public keys baked in. Ubuntu doesn't have to run this tool - actually there's probably a cool project idea for someone in standing up a little website to do this, either by letting you paste in public keys or grabbing them from the GitHub public API.)
      - pikchurn 9y ago
        As I said, I just want the .deb file on the iso.
- bryanlarsen 9y ago
  If you have SSHD in the minimal image then you have to deal with host keys. - on embedded and some other places where minimal images are used, generating the host key on first run can cause a very significant startup delay. - on some container environments, environments are so identical that you might not have enough entropy to generate sufficiently unique keys. - if somebody generates a host key and then creates an image from a running container, then you might end up distributing a host key, making what should be private public. I've probably got some of these details wrong and am going to be promptly corrected, but there are some very good reasons for excluding sshd.
Afforess 9y ago
My 2 cents, and possibly quite wrong: Is the ncurses packages really necessary in the minimal ubuntu image? It seems likely that curses based programs should be likely candidates for exclusion in a minimal image, as they are not usually meant for automation. Also, why are there still motd files in /etc/update-motd.d? No sshd but still a motd? Odd.
- deleted 9y ago
  [deleted]
- saosebastiao 9y ago
  Doesn't the installer use ncurses?
  - jchw 9y ago
    If I understand correctly, the intention for the minimal image is to be used in things like Docker containers and other lightweight environments, and not only do they lack an installer, but they also lack a kernel or bootloader; essentially, it would be composed of a minimal chroot.
    - Aloha 9y ago
      they still need the configuration tools though
      - isostatic 9y ago
        ncurses isn't required as part of the configuration -- debconf allows command line setting (and reading) of variables, and if it runs in a headless environment things like "note" get emailed to root if they can't be displayed. Our ubuntu builds are either 1) On real hardware, in which case it's a network boot which takes an IP address etc, and configured the partitions but allows you to override it (you have to press ok) or 2) On KVM builds, where virt-install is used, network detail is specified on the command line upfront and partitioning is fully automatic. Thus the majority of debconf settings are either default (a requirement of the package manager is a sensible default), or specified in the preseed file.
butz 9y ago
Would be nice if desktop Ubuntu images became smaller as well. I have a few 1GB USB drives just waiting for it.
- dustinkirkland 9y ago
  Stay tuned :-) That's my next post...
LinuxBender 9y ago
Somewhat off topic: Is there an effort similar to this for CentOS 7? The centos minimal image is still rather large and I have to do some really ugly things to prune it down. Even then I can not get it down anywhere close to 80 MB. That would be amazing.
- anonacct37 9y ago
  It's been my experience that people are less open to hacking CentOS/RedHat. It's pretty much you get what you get and changing anything makes it unsupported which defeats the purpose of using an enterprise distribution. That's not my opinion, it's what seems to be the community's opinion when you bring up things like using non-stock kernels.
  - LinuxBender 9y ago
    CentOS is only community supported, so that is ok. I am not suggesting customizing kernels.
  - mastax 9y ago
    Seems like it would make sense to have a CentOS version of RHEL Atomic Host/Fedora Atomic though? (I know nothing about CentOS)
    - emmelaich 9y ago
      https://wiki.centos.org/SpecialInterestGroup/Atomic/Download https://wiki.centos.org/SpecialInterestGroup/Atomic/Download
mwj 9y ago
If this is for deployment, why not just use debian slim?
- make3 9y ago
  I suspect, though I could be wrong, that the reason would be that some packages support Ubuntu specifically and not Debian, because of a larger consumer user base. An important example of this is the Nvidia CUDA toolkit, which supports Ubuntu and not Debian.
tomc1985 9y ago
Wonderful, I've always hated how much crap a default Ubuntu install comes with. 10% idle CPU usage just after OS install? Ewww.
- Lev1a 9y ago
  How many DECADES old is your hardware that an idling just-set-up Ubuntu uses 10% CPU?
fotcorn 9y ago
I did a short comparision between this and alpine by installing nginx inside the image (I used nginx-light inside ubuntu): CONTAINER ID IMAGE SIZE 493450e7bc12 alpine 1.37MB (virtual 5.52MB) 62b1db90500c ubuntu:bionic 6MB (virtual 87MB) I deleted the cache files from apt after installing (/var/lib/apt/lists*) Looks quite nice, but it seems Ubuntu packages are much bigger than Alpine package, e.g. Postgres is 159 MB in Ubuntu Bionic and only 32 MB in Alpine (including dependencies). Do the Ubuntu packages have more feature than the equivalent Alpine packages?
- verst 9y ago
  That's very interesting. I would love for someone to dig deeper into this. What happens if you do a multistage build (to get rid of the build tools once you don't need them) and compile Postgres from source on Alpine and Bionic?
  - seanp2k2 9y ago
    Consider how dope it'd be to ~"tree-shake" packages based on config files, if doing immutable infrastructure. Basically, only compile / include the features of the services you run based on what's required by the config files. I'm sure that this is a complex problem, but it shouldn't be impossible to mostly / fully automate.
    - jackfraser 9y ago
      This is brilliant. You'd need to basically define every single compile-time param and then have your build process emit a customized binary (and retinue of supporting stuffs) that does just that and nothing else. Probably makes your total build time significantly longer; you'd need aggressive caching based on the feature flag set.
      - fermuch 9y ago
        This is mostly how gentoo works. You define global settings, like "gui" or "pulseaudio", and you also have per package features to enable or disable. After setting these up, when you install a package, it is installed using only the features you enabled, so you have a lot of control over what and how you make your system work.
verst 9y ago
This could be smaller by removing compilers and build headers. If I'm not mistaken I see GCC is currently part of this. I would prefer to manually install build-essentials when needed (I can then get rid of them after compiling via multistage builds). Alpine Linux specifically makes you manually install compilers and necessary headers via apk add --update build-base EDIT: Make is not being installed by default. But I would like to manually install GCC as needed (for a truly minimal image). EDIT2: I stand corrected. Looks like GCC isn't installed by default (which is exactly what we want for minimal images). Awesome.
- tomc1985 9y ago
  debian does that too
- roller 9y ago
  The gcc-7-base package (assuming that's what you're looking at) looks like it's just an empty directory to put various gcc things and some basic docs. https://packages.debian.org/sid/gcc-7-base https://packages.debian.org/sid/gcc-7-base https://packages.debian.org/sid/amd64/gcc-7-base/filelist https://packages.debian.org/sid/amd64/gcc-7-base/filelist
  - verst 9y ago
    Thanks! I was looking at [1] and wasn't sure if those were binaries. That's perfect then. Install GCC, compilers, build headers etc via `sudo apt-get install build-essential` when necessary. So this should be the same general approach as on Alpine. [1]: https://pastebin.ubuntu.com/26506363/ https://pastebin.ubuntu.com/26506363/
    - geofft 9y ago
      libgcc_s.so.1 is a collection of utility routines used by all sorts of programs. The entry named "gcc" is a directory (that contains only empty directories?). /usr/share/gcc-7/python/libstdcxx/ is from the libstdc++6 package (looks like gdb pretty-printers for C++ standard library types).
peterwwillis 9y ago
I used to build embedded Linux distros for a hobby. The best, least aggravating way to have minimal platforms is to build them from scratch. Not only are they 10-50x smaller, you have more visibility over what's installed, and it's easier to tailor to your use case.
- revelation 9y ago
  Something like OpenWRT or buildroot can fit into 8 MiB easy. These people have an actual reason to make small "containers" because flash is a big part of the BoM cost and adds up when you are shipping many thousands.
revelation 9y ago
What is the obsession with smaller images? If you are running out of disk space before CPU, RAM, IOPS, network, well there is a cheap fix for that.
- hamandcheese 9y ago
  Well, expanding disk space can be pretty disruptive even if it is cheap. No need to be wasteful.
- influx 9y ago
  Folks using virtual machines and containers trying to minimize bloat.
- geofft 9y ago
  Containerization - taking a deployment that previously was made of lots of apps running on one OS on one physical machine (or a relatively generous fraction of one, as a VM), and turning it into lots of apps each running on their OS on top of the same amount of machine. Containerization significantly increases disk usage for each container and probably increases RAM use a little bit, but to first order does not affect CPU or IOPS or network.
  - revelation 9y ago
    I understand it is about containers. But no disk space of the world is worth your container app crashing because someone wanted to save a few megabytes by ditching glibc or otherwise just pushing more work into each and every individual container. It's Java Enterprise all over, who cares it's always allocating tens of GiB of RAM, you have to get to the point of buying a lot of it before it makes an hour of an engineers time worthwhile.
- semiquaver 9y ago
  Docker. The size of your base image directly affects the size of application images that use it as a base layer.
- fmntf 9y ago
theandrewbailey 9y ago
I've been using the MinimalCD images[0] to install Ubuntu for years. (They are the minimum you need to boot, and they download everything else to install Ubuntu.) I'm guessing that these aren't what's being talked about. [0] https://help.ubuntu.com/community/Installation/MinimalCD https://help.ubuntu.com/community/Installation/MinimalCD
- KayEss 9y ago
  I'd been doing the same thing for a long time (loved how fast it was compared to the normal installer, especially in a VM), but the last install I did was with debootstrap straight onto the target disk from another running machine. A bit of a learning curve the first time, but I think I'll try it again next time.
segmondy 9y ago
Did most of you read the article? I see folks suggesting what can be removed. They can't do that. "The Ubuntu Minimal Image is the smallest base upon which a user can apt install any package in the Ubuntu archive."
- kstenerud 9y ago
  From the article: "Do you see any other opportunities for savings? Can you help us crop the Bionic Beaver images any further? Is there something that we've culled, that you see as problematic? We're interested in your feedback"
  - braindongle 9y ago
    "Crop the beaver"? Seriously? It also says "Shave the beaver"! Is it me? Is this thinly veiled high school innuendo?
    - y4mi 9y ago
      Considering your username, it's probably just you.
    - kuschku 9y ago
      Ubuntu uses animal names as codename for releases. After Artful Aardvark now follows Bionic Beaver.
      - pbhjpbhj 9y ago
        BB is some The GIMP level naming. Bison, Beetle, Badger, Baboon, ...
      - isostatic 9y ago
        Breezy Badger being already used (before they moved to incrementinf letter based system - having done hoary hedgehog and waryy warthog. It wasn't until the first LTS version, dapper drake, that the letters started matching the release number. The second LTS, or 8th release overall - Hardy Heron, in April 2008, was the second "hh" version. Shockingly we still have 6 hardy heron boxes on our network in far flung locations.
aplorbust 9y ago
Not a Linux user but out of curiosity just looked at the "Trusty Tahr" 37MB amd64 minimal image (mini.iso). Most recent amd64 minimal image is 58MB ("Artful Aardvark"). Trusty Tahr bzImage compressed kernel is 5.5MB. The initrd.cpio.gz is 20MB. The uncompressed initrd is 52MB. Assuming most of the initrd size is modules, can the Linux user reduce the size of the initrd by compiling own kernel and creating own initrd with only the modules she needs?
- subway 9y ago
  Or just ditch the kernel and initrd entirely. If you're trying to save a few MB on an Ubuntu image, you're almost certainly working in a container environment where you don't need a kernel inside the fs. If you really do need a kernel, and the few extra MB required by modules is a problem, you should probably be using Buildroot or Yocto for your bootloader/kernel.
  - gerdesj 9y ago
    I don't think everyone is working within a container when they boot a Ubuntu minimal, unless your containers happen to have a BIOS or similar. These things are a full OS installer ie put it on a USB key, CDROM, PXE boot or whatever. These are a minimal installer and not a minimal installation, although that is a side effect - you don't get much out of the box but you can add everything later. You could, for example, do a minimal install and then do "# apt install libreoffice" and with luck (not too sure) get the whole lot - X etc - to run it. You might have to add a Window Manager and a few other things.
    - subway 9y ago
      I agree -- there are plenty of reasons to use a minimal Ubuntu install. My point was that if size constraints are so tight that you feel trimming kernel modules out is a reasonable use of effort, then Ubuntu starts to be a more awkward fit. If you constantly have to trim away bits left by the package manager (man pages, examples, extra kernel modules), your time is probably better spent with a distro that allows you to avoid ever laying those into the rootfs to begin with. Also worth noting:these images are full minimal root filesystems. "installer" images refer to the images containing software --the debian/ubuntu installer for bootstrapping a root filesystem onto a mounted volume. The minimal images from thearticle do not contain this installer, and are stanalone root filesystems.
matt_wulfeck 9y ago
The problem with these 30 MB images: apt update -y apt install -y telnet Now you have a 200 MB image.
- bartkmq 9y ago
  For comparison with Alpine Linux: base kbd-bkeymaps, xz compressed: 2.8 MB base kbd-bkeymaps busybox-extras, xz compressed: 2.8 MB Just 100 kB more for telnet, no extra deps. I wouldn't actually want to work in that chroot but for containers it's fine.
- gerdesj 9y ago
  I think you miss the point but feel free to provide feedback to the devs: this is a RFC after all. I have used the minimals for years now and they really do give you a pretty decent starter for 10, with a minimum of hassle and a minimum of bloat. Boot the ISO (PXE, obviously) and off you go. Even doing the install by hand, you get a fully patched basic server up and running within 10-20 minutes - the install is all off the current packages. Add Samba and a few copy n pastes and you have AD joined. A few more copy n pastes from your docs and you have an app server. I wrote this lot: https://www.mediawiki.org/wiki/Intranet https://www.mediawiki.org/wiki/Intranet which simply assumes Ubuntu mini at the moment. I do have screenshots and could put together a pretty noddy guide for that bit but I'm not sure its necessary. Actually now I come to think of it, it probably is. Couple that with my Ref. build and you have a domain joined, Kerberized etc app server within about an hour if you do the job by hand and are unfamiliar with the process. I can do it rather quicker. Yes, the installer is a 30MB image - good. An installer's size is no reflection on the installation size. EDIT: I am from the sysadmin side of things and not dev ops ...
  - isostatic 9y ago
    If you're doing pxe (which I fully support) and installing a full release why would you have anything more than a kernel, initrd, and pressed file? Take about 4 minutes to build from scratch. Containers of corse are a different issue, but I'd probably use something like coreos as the host in that case.
  - 9y ago
hodl 9y ago
How big is templeos LTS minimal IMG?
- hodl 9y ago
  16mb
KingEllis 9y ago
I have feedback on the Ubuntu 18.04 LTS Cloud Image that I am hoping reaches the right ears. There is something about the way the disk is partitioned that makes the use of virt-resize no longer work (as it does for 16.04). Specifically, I am referring to: https://cloud-images.ubuntu.com/bionic/20180124/bionic-server-cloudimg-amd64.img https://cloud-images.ubuntu.com/bionic/20180124/bionic-serve... The boot partion looks to be sda14 or sda15. But judging from the output of virt-resize, it appears that although these are sda14/15, they appear in front of sda1. (When virt-resize is run on sda1, sda14 becomes sda1, sda15 becomes sda2, and sda1 is now the resized sda3, and grub is confused. $ virt-filesystems --long --parts --blkdevs -h -a bionic-server-cloudimg-amd64.img Name Type MBR Size Parent /dev/sda1 partition - 2.1G /dev/sda /dev/sda14 partition - 4.0M /dev/sda /dev/sda15 partition - 106M /dev/sda /dev/sda device - 2.2G - $ virt-resize --expand /dev/sda1 bionic-server-cloudimg-amd64.img bionic0.qcow2 $ virt-filesystems --long --parts --blkdevs -h -a bionic0.qcow2 Name Type MBR Size Parent /dev/sda1 partition - 4.0M /dev/sda /dev/sda2 partition - 106M /dev/sda /dev/sda3 partition - 25G /dev/sda /dev/sda device - 25G - I am hoping this can be addressed before April, as I would prefer not to maintain my own LTS image (that doesn't have this issue).
- dustinkirkland 9y ago
  Thanks! I'll make sure that gets to the right team!

280 points by pella 9y ago

Posting here rather than the blog because I don't have a google account: What about adding sshd to the minimal install? If the purpose of this is minimal installs of containers and cloud servers and such, that seems like quite an omission.

the8472 9y ago
Container/VM management software may already provide a way to remote into them, so that would be redundant. Plus it's a minimal image, you can build your own intermediate one on top of that with SSH added.
- sofaofthedamned 9y ago
  They don't necessarily give you a way of getting into the node, especially if it's in a broken state (which is the time i'd want to have a look) EDIT: I was wrong, this is made to be a container base, not for the nodes themselves (there is no init system)
deleted 9y ago
[deleted]
acomar 9y ago
This is supposed to run inside of a container. Why would you want sshd inside of a container?
- sofaofthedamned 9y ago
  It isn't clear afaik. Maybe i'd like this as an alternative to CoreOS or whatever for my k8s nodes? EDIT: Good point, you're right, it has no init system etc and is meant to be used in a container. Point conceded :)
  - hosh 9y ago
    I wouldn't be surprised if Ubuntu started a project similar to Redhat Atomic (and now CoreOS/ContainerOS). On GKE, one advantage of using Ubuntu as the node OS is you can get access to Sysdig or OpenEBS.
    - sofaofthedamned 9y ago
      We've moved at work to mainly Alpine based k8s containers, which is awesome, but you lose a lot of debug ability. Thinking about it - with Linux KSM the overhead of full-fat containers based on Ubuntu (for example) isn't massive. We may have to look at the metrics I reckon.
    - dustinkirkland 9y ago
      You're looking for Ubuntu Core.
      - hosh 9y ago
        Looking at Ubuntu Core, not sure it is doing the same kind of things that CoreOS ContainerOS, Google's ContainerOS, and Redhat Atomic is doing.
- deleted 9y ago
  [deleted]
- unethical_ban 9y ago
  Not arguing that point for this image, but I use containers as lightweight VMs, not only as stateless-horizontally-scalable-try-to-be-google app servers.
  - tomc1985 9y ago
    It's stupid that you've been downvoted. It is so tiresome to see people ask such useless questions like "what? you want to use this thing in some way that my tiny brain cannot envision? what is this madness?"
    - lox 9y ago
      His reply was snarky and created a false dichotomy. The 90% usecase exists in between “lightweight VM’s” and google scale horizontal app deployment. Consider that the former is just as much an outlier as the latter. This post is about a pragmatic minimal Ubuntu base image, which would meet neither case well.
      - unethical_ban 9y ago
        It was snarky. But there is a dichotomy: It's either stateless or stateful. Either I'm supposed to SSH to it or I'm supposed to destroy and redeploy.
        lox 9y ago
        Again, consider that you are creating this dichotomy, not the tools, or vast majority of practitioners in this space. Docker comes with (and encourages) lots of ways to persist state, as do orchestration environments like Kubernetes and ECS and you should choose the approach that suits the problem you are solving. If you want containers as lightweight VM's, there are a ton of ways to do that and they are actively supported. I'm reluctant to get off-topic here, because the narrative relating to the actual post should be "Does it makes sense to have openssh in a minimal ubuntu base image", to which the answer is "No, obviously".
  - 9y ago
- pikchurn 9y ago
  I use containers as lightweight VMs in many places. Generally I see this as a way to get a minimal install that other tools can then configure appropriately, with up to date packages fetched from upstream mirrors directly, instead of installed from CD and then upgraded. I currently use packer.io to script the creation of a bunch of server images, and for ubuntu I've missed the "minimal install CD" that other distros have. Instead packer has to download a 800MB CD image, in order to install only a few hundred megabytes of uncompressed packages in a bare-bones install, which is then provisioned using some orchestration tool that at its heart uses ssh to login to the virtual machine. Not having SSH means you need to add in some sort of serial-attach step to manually install sshd, or hook into the install scripts to download sshd as part of the install or whatever. Either way that's additional custom work that is probably common to a great many use cases.
  - isostatic 9y ago
    Just do a netboot with a preseed file (have your own local cache - either with apt-cacher or something more independent) Our server preseed has the following line d-i pkgsel/include string openssh-server build-essential iperf htop screen sysstat vim-nox And a couple of internal packages which have their own dependencies (including lldp, snmpd etc) which do a variety of things including user management (active directory based), automatic registration into our asset database and monitoring systems
  - moondev 9y ago
    This is meant as a base image for containers. There's not even a kernel or init
  - verst 9y ago
    So why not build your own version with a SSH daemon if you really need it? I don't think most people need the SSH daemon in their container image. Your Dockerfile could be something like this: FROM ubuntu:bionic RUN sudo apt-get install openssh-server -y && sudo service ssh restart These are definitely not the complete steps for setting up SSHd but you get the idea.
  - acomar 9y ago
riffic 9y ago
I don't want an sshd installed by default in my containers. What's your use case?
- pikchurn 9y ago
  I'm not saying by default. I'm saying have it on the CD.
  - geofft 9y ago
    I often boot machines connected to the public internet or to a coffeeshop / other public wifi with the Ubuntu live CD, so I wouldn't like the live CD to have an sshd with a well-known password out-of-the-box. So if you're going to have to log into the machine to customize authentication anyway, you already have enough access to `apt-get install openssh-server`. (It would be nice to have a one-click tool that builds you a customized image with your own SSH public keys baked in. Ubuntu doesn't have to run this tool - actually there's probably a cool project idea for someone in standing up a little website to do this, either by letting you paste in public keys or grabbing them from the GitHub public API.)
    - pikchurn 9y ago
      As I said, I just want the .deb file on the iso.
bryanlarsen 9y ago
If you have SSHD in the minimal image then you have to deal with host keys. - on embedded and some other places where minimal images are used, generating the host key on first run can cause a very significant startup delay. - on some container environments, environments are so identical that you might not have enough entropy to generate sufficiently unique keys. - if somebody generates a host key and then creates an image from a running container, then you might end up distributing a host key, making what should be private public. I've probably got some of these details wrong and am going to be promptly corrected, but there are some very good reasons for excluding sshd.

Afforess 9y ago

My 2 cents, and possibly quite wrong: Is the ncurses packages really necessary in the minimal ubuntu image? It seems likely that curses based programs should be likely candidates for exclusion in a minimal image, as they are not usually meant for automation. Also, why are there still motd files in /etc/update-motd.d? No sshd but still a motd? Odd.

deleted 9y ago
[deleted]
saosebastiao 9y ago
Doesn't the installer use ncurses?
- jchw 9y ago
  If I understand correctly, the intention for the minimal image is to be used in things like Docker containers and other lightweight environments, and not only do they lack an installer, but they also lack a kernel or bootloader; essentially, it would be composed of a minimal chroot.
  - Aloha 9y ago
    they still need the configuration tools though
    - isostatic 9y ago
      ncurses isn't required as part of the configuration -- debconf allows command line setting (and reading) of variables, and if it runs in a headless environment things like "note" get emailed to root if they can't be displayed. Our ubuntu builds are either 1) On real hardware, in which case it's a network boot which takes an IP address etc, and configured the partitions but allows you to override it (you have to press ok) or 2) On KVM builds, where virt-install is used, network detail is specified on the command line upfront and partitioning is fully automatic. Thus the majority of debconf settings are either default (a requirement of the package manager is a sensible default), or specified in the preseed file.

butz 9y ago

Would be nice if desktop Ubuntu images became smaller as well. I have a few 1GB USB drives just waiting for it.

dustinkirkland 9y ago
Stay tuned :-) That's my next post...

LinuxBender 9y ago

Somewhat off topic: Is there an effort similar to this for CentOS 7? The centos minimal image is still rather large and I have to do some really ugly things to prune it down. Even then I can not get it down anywhere close to 80 MB. That would be amazing.

anonacct37 9y ago
It's been my experience that people are less open to hacking CentOS/RedHat. It's pretty much you get what you get and changing anything makes it unsupported which defeats the purpose of using an enterprise distribution. That's not my opinion, it's what seems to be the community's opinion when you bring up things like using non-stock kernels.
- LinuxBender 9y ago
  CentOS is only community supported, so that is ok. I am not suggesting customizing kernels.
- mastax 9y ago
  Seems like it would make sense to have a CentOS version of RHEL Atomic Host/Fedora Atomic though? (I know nothing about CentOS)
  - emmelaich 9y ago
    https://wiki.centos.org/SpecialInterestGroup/Atomic/Download https://wiki.centos.org/SpecialInterestGroup/Atomic/Download

mwj 9y ago

If this is for deployment, why not just use debian slim?

make3 9y ago
I suspect, though I could be wrong, that the reason would be that some packages support Ubuntu specifically and not Debian, because of a larger consumer user base. An important example of this is the Nvidia CUDA toolkit, which supports Ubuntu and not Debian.

tomc1985 9y ago

Wonderful, I've always hated how much crap a default Ubuntu install comes with. 10% idle CPU usage just after OS install? Ewww.

Lev1a 9y ago
How many DECADES old is your hardware that an idling just-set-up Ubuntu uses 10% CPU?

fotcorn 9y ago

I did a short comparision between this and alpine by installing nginx inside the image (I used nginx-light inside ubuntu): CONTAINER ID IMAGE SIZE 493450e7bc12 alpine 1.37MB (virtual 5.52MB) 62b1db90500c ubuntu:bionic 6MB (virtual 87MB) I deleted the cache files from apt after installing (/var/lib/apt/lists*) Looks quite nice, but it seems Ubuntu packages are much bigger than Alpine package, e.g. Postgres is 159 MB in Ubuntu Bionic and only 32 MB in Alpine (including dependencies). Do the Ubuntu packages have more feature than the equivalent Alpine packages?

verst 9y ago
That's very interesting. I would love for someone to dig deeper into this. What happens if you do a multistage build (to get rid of the build tools once you don't need them) and compile Postgres from source on Alpine and Bionic?
- seanp2k2 9y ago
  Consider how dope it'd be to ~"tree-shake" packages based on config files, if doing immutable infrastructure. Basically, only compile / include the features of the services you run based on what's required by the config files. I'm sure that this is a complex problem, but it shouldn't be impossible to mostly / fully automate.
  - jackfraser 9y ago
    This is brilliant. You'd need to basically define every single compile-time param and then have your build process emit a customized binary (and retinue of supporting stuffs) that does just that and nothing else. Probably makes your total build time significantly longer; you'd need aggressive caching based on the feature flag set.
    - fermuch 9y ago
      This is mostly how gentoo works. You define global settings, like "gui" or "pulseaudio", and you also have per package features to enable or disable. After setting these up, when you install a package, it is installed using only the features you enabled, so you have a lot of control over what and how you make your system work.

verst 9y ago

This could be smaller by removing compilers and build headers. If I'm not mistaken I see GCC is currently part of this. I would prefer to manually install build-essentials when needed (I can then get rid of them after compiling via multistage builds). Alpine Linux specifically makes you manually install compilers and necessary headers via apk add --update build-base EDIT: Make is not being installed by default. But I would like to manually install GCC as needed (for a truly minimal image). EDIT2: I stand corrected. Looks like GCC isn't installed by default (which is exactly what we want for minimal images). Awesome.

tomc1985 9y ago
debian does that too
roller 9y ago
The gcc-7-base package (assuming that's what you're looking at) looks like it's just an empty directory to put various gcc things and some basic docs. https://packages.debian.org/sid/gcc-7-base https://packages.debian.org/sid/gcc-7-base https://packages.debian.org/sid/amd64/gcc-7-base/filelist https://packages.debian.org/sid/amd64/gcc-7-base/filelist
- verst 9y ago
  Thanks! I was looking at [1] and wasn't sure if those were binaries. That's perfect then. Install GCC, compilers, build headers etc via `sudo apt-get install build-essential` when necessary. So this should be the same general approach as on Alpine. [1]: https://pastebin.ubuntu.com/26506363/ https://pastebin.ubuntu.com/26506363/
  - geofft 9y ago
    libgcc_s.so.1 is a collection of utility routines used by all sorts of programs. The entry named "gcc" is a directory (that contains only empty directories?). /usr/share/gcc-7/python/libstdcxx/ is from the libstdc++6 package (looks like gdb pretty-printers for C++ standard library types).

peterwwillis 9y ago

I used to build embedded Linux distros for a hobby. The best, least aggravating way to have minimal platforms is to build them from scratch. Not only are they 10-50x smaller, you have more visibility over what's installed, and it's easier to tailor to your use case.

revelation 9y ago
Something like OpenWRT or buildroot can fit into 8 MiB easy. These people have an actual reason to make small "containers" because flash is a big part of the BoM cost and adds up when you are shipping many thousands.

revelation 9y ago

What is the obsession with smaller images? If you are running out of disk space before CPU, RAM, IOPS, network, well there is a cheap fix for that.

hamandcheese 9y ago
Well, expanding disk space can be pretty disruptive even if it is cheap. No need to be wasteful.
influx 9y ago
Folks using virtual machines and containers trying to minimize bloat.
geofft 9y ago
Containerization - taking a deployment that previously was made of lots of apps running on one OS on one physical machine (or a relatively generous fraction of one, as a VM), and turning it into lots of apps each running on their OS on top of the same amount of machine. Containerization significantly increases disk usage for each container and probably increases RAM use a little bit, but to first order does not affect CPU or IOPS or network.
- revelation 9y ago
  I understand it is about containers. But no disk space of the world is worth your container app crashing because someone wanted to save a few megabytes by ditching glibc or otherwise just pushing more work into each and every individual container. It's Java Enterprise all over, who cares it's always allocating tens of GiB of RAM, you have to get to the point of buying a lot of it before it makes an hour of an engineers time worthwhile.
semiquaver 9y ago
Docker. The size of your base image directly affects the size of application images that use it as a base layer.
fmntf 9y ago

theandrewbailey 9y ago

I've been using the MinimalCD images[0] to install Ubuntu for years. (They are the minimum you need to boot, and they download everything else to install Ubuntu.) I'm guessing that these aren't what's being talked about. [0] https://help.ubuntu.com/community/Installation/MinimalCD https://help.ubuntu.com/community/Installation/MinimalCD

KayEss 9y ago
I'd been doing the same thing for a long time (loved how fast it was compared to the normal installer, especially in a VM), but the last install I did was with debootstrap straight onto the target disk from another running machine. A bit of a learning curve the first time, but I think I'll try it again next time.

segmondy 9y ago

Did most of you read the article? I see folks suggesting what can be removed. They can't do that. "The Ubuntu Minimal Image is the smallest base upon which a user can apt install any package in the Ubuntu archive."

kstenerud 9y ago
From the article: "Do you see any other opportunities for savings? Can you help us crop the Bionic Beaver images any further? Is there something that we've culled, that you see as problematic? We're interested in your feedback"
- braindongle 9y ago
  "Crop the beaver"? Seriously? It also says "Shave the beaver"! Is it me? Is this thinly veiled high school innuendo?
  - y4mi 9y ago
    Considering your username, it's probably just you.
  - kuschku 9y ago
    Ubuntu uses animal names as codename for releases. After Artful Aardvark now follows Bionic Beaver.
    - pbhjpbhj 9y ago
      BB is some The GIMP level naming. Bison, Beetle, Badger, Baboon, ...
    - isostatic 9y ago
      Breezy Badger being already used (before they moved to incrementinf letter based system - having done hoary hedgehog and waryy warthog. It wasn't until the first LTS version, dapper drake, that the letters started matching the release number. The second LTS, or 8th release overall - Hardy Heron, in April 2008, was the second "hh" version. Shockingly we still have 6 hardy heron boxes on our network in far flung locations.

aplorbust 9y ago

Not a Linux user but out of curiosity just looked at the "Trusty Tahr" 37MB amd64 minimal image (mini.iso). Most recent amd64 minimal image is 58MB ("Artful Aardvark"). Trusty Tahr bzImage compressed kernel is 5.5MB. The initrd.cpio.gz is 20MB. The uncompressed initrd is 52MB. Assuming most of the initrd size is modules, can the Linux user reduce the size of the initrd by compiling own kernel and creating own initrd with only the modules she needs?

subway 9y ago
Or just ditch the kernel and initrd entirely. If you're trying to save a few MB on an Ubuntu image, you're almost certainly working in a container environment where you don't need a kernel inside the fs. If you really do need a kernel, and the few extra MB required by modules is a problem, you should probably be using Buildroot or Yocto for your bootloader/kernel.
- gerdesj 9y ago
  I don't think everyone is working within a container when they boot a Ubuntu minimal, unless your containers happen to have a BIOS or similar. These things are a full OS installer ie put it on a USB key, CDROM, PXE boot or whatever. These are a minimal installer and not a minimal installation, although that is a side effect - you don't get much out of the box but you can add everything later. You could, for example, do a minimal install and then do "# apt install libreoffice" and with luck (not too sure) get the whole lot - X etc - to run it. You might have to add a Window Manager and a few other things.
  - subway 9y ago
    I agree -- there are plenty of reasons to use a minimal Ubuntu install. My point was that if size constraints are so tight that you feel trimming kernel modules out is a reasonable use of effort, then Ubuntu starts to be a more awkward fit. If you constantly have to trim away bits left by the package manager (man pages, examples, extra kernel modules), your time is probably better spent with a distro that allows you to avoid ever laying those into the rootfs to begin with. Also worth noting:these images are full minimal root filesystems. "installer" images refer to the images containing software --the debian/ubuntu installer for bootstrapping a root filesystem onto a mounted volume. The minimal images from thearticle do not contain this installer, and are stanalone root filesystems.

matt_wulfeck 9y ago

The problem with these 30 MB images: apt update -y apt install -y telnet Now you have a 200 MB image.

bartkmq 9y ago
For comparison with Alpine Linux: base kbd-bkeymaps, xz compressed: 2.8 MB base kbd-bkeymaps busybox-extras, xz compressed: 2.8 MB Just 100 kB more for telnet, no extra deps. I wouldn't actually want to work in that chroot but for containers it's fine.
gerdesj 9y ago
I think you miss the point but feel free to provide feedback to the devs: this is a RFC after all. I have used the minimals for years now and they really do give you a pretty decent starter for 10, with a minimum of hassle and a minimum of bloat. Boot the ISO (PXE, obviously) and off you go. Even doing the install by hand, you get a fully patched basic server up and running within 10-20 minutes - the install is all off the current packages. Add Samba and a few copy n pastes and you have AD joined. A few more copy n pastes from your docs and you have an app server. I wrote this lot: https://www.mediawiki.org/wiki/Intranet https://www.mediawiki.org/wiki/Intranet which simply assumes Ubuntu mini at the moment. I do have screenshots and could put together a pretty noddy guide for that bit but I'm not sure its necessary. Actually now I come to think of it, it probably is. Couple that with my Ref. build and you have a domain joined, Kerberized etc app server within about an hour if you do the job by hand and are unfamiliar with the process. I can do it rather quicker. Yes, the installer is a 30MB image - good. An installer's size is no reflection on the installation size. EDIT: I am from the sysadmin side of things and not dev ops ...
- isostatic 9y ago
  If you're doing pxe (which I fully support) and installing a full release why would you have anything more than a kernel, initrd, and pressed file? Take about 4 minutes to build from scratch. Containers of corse are a different issue, but I'd probably use something like coreos as the host in that case.
- 9y ago

hodl 9y ago

How big is templeos LTS minimal IMG?

hodl 9y ago
16mb

KingEllis 9y ago

I have feedback on the Ubuntu 18.04 LTS Cloud Image that I am hoping reaches the right ears. There is something about the way the disk is partitioned that makes the use of virt-resize no longer work (as it does for 16.04). Specifically, I am referring to: https://cloud-images.ubuntu.com/bionic/20180124/bionic-server-cloudimg-amd64.img https://cloud-images.ubuntu.com/bionic/20180124/bionic-serve... The boot partion looks to be sda14 or sda15. But judging from the output of virt-resize, it appears that although these are sda14/15, they appear in front of sda1. (When virt-resize is run on sda1, sda14 becomes sda1, sda15 becomes sda2, and sda1 is now the resized sda3, and grub is confused. $ virt-filesystems --long --parts --blkdevs -h -a bionic-server-cloudimg-amd64.img Name Type MBR Size Parent /dev/sda1 partition - 2.1G /dev/sda /dev/sda14 partition - 4.0M /dev/sda /dev/sda15 partition - 106M /dev/sda /dev/sda device - 2.2G - $ virt-resize --expand /dev/sda1 bionic-server-cloudimg-amd64.img bionic0.qcow2 $ virt-filesystems --long --parts --blkdevs -h -a bionic0.qcow2 Name Type MBR Size Parent /dev/sda1 partition - 4.0M /dev/sda /dev/sda2 partition - 106M /dev/sda /dev/sda3 partition - 25G /dev/sda /dev/sda device - 25G - I am hoping this can be addressed before April, as I would prefer not to maintain my own LTS image (that doesn't have this issue).

dustinkirkland 9y ago
Thanks! I'll make sure that gets to the right team!