8 ms·
For statically linked binaries, why wouldn't you use the SCRATCH (0 kb) 'image'?
by snarfy 7y ago
For statically linked binaries, why wouldn't you use the SCRATCH (0 kb) 'image'?
- hssys 7y agoYou might want at least a shell in the container for debugging?
- souterrain 7y agoAdding a shell seems antithetical to deploying production code as a static-linked binary, not to mention an expansion of the attack surface of the container.
- hibbelig 7y agoWithout a shell, how does one debug if anything goes wrong?
- antsar 7y agoReading logs/traces on your log aggregation service and reproducing in a dev system?
- jeremyjh 7y agoHow do you debug in the dev env without a shell?
- y04nn 7y agoWith remote debugging?
- lstodd 7y agoremote debugging is a shell
- the8472 7y agonot necessarily. e.g. java runtimes can expose debugging ports when needed that operate on a custom protocol. or you can just build gdb into the container and run the process under gdb, then attach to the tty. or you can debug from the host system where the container's pid namespace is a descendant of the root namespace and the other namespaces can be accessed via /proc or unshare.
- lstodd 7y agoWhat I meant is having a remote debugger is as good as having a remote shell in terms of remote code execution.
- the8472 7y agofrom the host system, containers don't exist in a vacuum
- hundt 7y agoYou can start a container with a shell that shares the PID and network namespaces of the container you want to debug.
- discreteevent 7y agoDebugging is about when the difference between theory and practice breaks down.
- ecnahc515 7y agoYou can use nsenter
- ImJasonH 7y agoDistroless has debug images for this purpose: https://github.com/GoogleContainerTools/distroless/blob/master/README.md#debug-images https://github.com/GoogleContainerTools/distroless/blob/mast...
- yegle 7y agoFor almost any serious job running in production, you might need CA certificates and openssl.
- sofaofthedamned 7y agoUnless you're behind a load balancer which terminates TLS and the traffic you deal with is purely http.
- briffle 7y agosure, as long as you don't connect to ANY outside url's for anything
- aflag 7y agoWhich you probably shouldn't be doing for most of your services anyway.
- icebraining 7y agoI don't remember the last project I did which didn't have some sort of integration with an external service. I guess if you use microservices, most components won't need it; I mostly use monoliths.
- aflag 7y agoI guess if everything is in a single service you're bound to have some sort of outbound connection at some point. Although, in my experience, you can go very far within your vpc.
- alanwreath 7y agoI wonder if this would be important with service mesh and mutual tls...
- 7y ago
- alpb 7y agoYou would. Except most statically linked binaries may still need ca-certificates, tzdata, and some other files that libraries expect it to be present on the system. Not to mention, you still need runtimes if you are programming in Java, Python or many other languages. https://github.com/GoogleContainerTools/distroless https://github.com/GoogleContainerTools/distroless project gives a way to have these runtimes + their lib dependencies while still maintaining a minimal attack surface.
- sofaofthedamned 7y agoDepends. Normally I would do with golang apps. But if I need to debug an issue I'll redeploy them with Ubuntu underneath so I can use the debugging tools.
- stephenr 7y agoIf your binary is static, why do you need a container at all?
- jpwgarrison 7y agoSo you can justify using k8s and shine up your resume!
- stephenr 7y agoIt’s the new 3x SQLServer + 2x IIS + 2x SharePoint cluster to serve an intranet for 100 staff when a single <insert oss wiki on linux> would be more than sufficient.