9 ms·
For anyone who want a small image but with glibc, https://github.com/GoogleContainerTools/distroless https://github.com/GoogleContainerTools/distroless is a goo
by yegle 7y ago
For anyone who want a small image but with glibc, https://github.com/GoogleContainerTools/distroless https://github.com/GoogleContainerTools/distroless is a good choice, especially if you are writing in static linked language e.g. Go and Rust.
- Jonanin 7y agoFor Python I'd also highly recommend Clear Linux for raw performance. It's not quite as easy to get started as with something like Ubuntu though.
- mixmastamyk 7y agoChecked it out, is Intel supported with compiler tweaks to get the most out of their CPUs, for libs like math, pandas, etc.
- pella 7y agodocker pull clearlinux/python https://github.com/clearlinux/dockerfiles/tree/master/python https://github.com/clearlinux/dockerfiles/tree/master/python
- svacko 7y agoClear Linux is definitely an interesting project, however, using base image with 'latest' tag (only tag existing for https://hub.docker.com/r/clearlinux/python/tags https://hub.docker.com/r/clearlinux/python/tags) in the production is not a best strategy as the breaking changes can arrive anytime
- snarfy 7y agoFor statically linked binaries, why wouldn't you use the SCRATCH (0 kb) 'image'?
- hssys 7y agoYou might want at least a shell in the container for debugging?
- souterrain 7y agoAdding a shell seems antithetical to deploying production code as a static-linked binary, not to mention an expansion of the attack surface of the container.
- hibbelig 7y agoWithout a shell, how does one debug if anything goes wrong?
- antsar 7y agoReading logs/traces on your log aggregation service and reproducing in a dev system?
- jeremyjh 7y agoHow do you debug in the dev env without a shell?
- y04nn 7y agoWith remote debugging?
- lstodd 7y agoremote debugging is a shell
- the8472 7y agonot necessarily. e.g. java runtimes can expose debugging ports when needed that operate on a custom protocol. or you can just build gdb into the container and run the process under gdb, then attach to the tty. or you can debug from the host system where the container's pid namespace is a descendant of the root namespace and the other namespaces can be accessed via /proc or unshare.
- yegle 7y agoFor almost any serious job running in production, you might need CA certificates and openssl.
- sofaofthedamned 7y agoUnless you're behind a load balancer which terminates TLS and the traffic you deal with is purely http.
- briffle 7y agosure, as long as you don't connect to ANY outside url's for anything
- aflag 7y agoWhich you probably shouldn't be doing for most of your services anyway.
- icebraining 7y agoI don't remember the last project I did which didn't have some sort of integration with an external service. I guess if you use microservices, most components won't need it; I mostly use monoliths.
- aflag 7y agoI guess if everything is in a single service you're bound to have some sort of outbound connection at some point. Although, in my experience, you can go very far within your vpc.
- alanwreath 7y agoI wonder if this would be important with service mesh and mutual tls...
- 7y ago
- alpb 7y agoYou would. Except most statically linked binaries may still need ca-certificates, tzdata, and some other files that libraries expect it to be present on the system. Not to mention, you still need runtimes if you are programming in Java, Python or many other languages. https://github.com/GoogleContainerTools/distroless https://github.com/GoogleContainerTools/distroless project gives a way to have these runtimes + their lib dependencies while still maintaining a minimal attack surface.
- sofaofthedamned 7y agoDepends. Normally I would do with golang apps. But if I need to debug an issue I'll redeploy them with Ubuntu underneath so I can use the debugging tools.
- stephenr 7y agoIf your binary is static, why do you need a container at all?
- jpwgarrison 7y agoSo you can justify using k8s and shine up your resume!
- stephenr 7y agoIt’s the new 3x SQLServer + 2x IIS + 2x SharePoint cluster to serve an intranet for 100 staff when a single <insert oss wiki on linux> would be more than sufficient.
- catern 7y ago"distroless" is just Debian packages. Their self-description is fairly annoyingly misleading, since they don't mention that they are just using packages from Debian.
- yegle 7y agoWhy is that a bad thing? Binaries are binaries, whether you copied from a deb package or completely built from source code (assuming reproducible build, which Debian supports), they are the same.
- catern 7y agoIt's absolutely not a bad thing, indeed I think it's a good thing to use binaries from Debian. I just think the name of the project is strongly misleading. "distroless" is built from the Debian distribution, not something new made from scratch.
- hobofan 7y agoNot sure how widespread that view is, but that's never the association I would have made. "Xless" is just a different way of saying "without X". "fearless" = "without fear"; "serverless" = "without a server" (yes, I know, not really); so "distroless" = "(comes) without a distribution" So in my opinon the name correctly suggests that it's "just the package" and comes "without a distro", and not "was built without the help of a distribution".
- geezerjay 7y ago> Binaries are binaries, whether you copied from a deb package or completely built from source code No, they are not. Debian packages are deployable packages, which are built around packages and services and conventions adopted and provided by the target distribution.
- collinmanderson 7y agoit should probably be called "package-manager-less" because there's no package manager in the final build, but there's also no ls, etc, so distroless kinda makes sense. Maybe systemless?
- sprydevl 7y agoIf you want small images, why not use a tool like https://github.com/docker-slim/docker-slim https://github.com/docker-slim/docker-slim Then it doesn’t matter which distro you favor?
- GordonS 7y agoWow, I've never heard of this before - I'm looking forward to seeing how much this shrinks my images!
- onlydeadheroes 7y agoSearch for "awesome-docker" and make sure you have some free time. :)
- nurettin 7y agoI don't quite get it. If you've somehow statically compiled all your dependencies, shouldn't that just run without a container? Perhaps the point is not to enable program execution, but to make use of the benefits that may come with container orchestration.
- spacenick88 7y agoWell at the very least running in a container gives you filesystem and network and PID space isolation, optionally also user namespace isolation.