5 ms·
FWIW, if you wanted to get the static from-scratch go image a lot smaller, try running the binary through UPX. It typically improves compiled go binary sizes by
by paulfurtado 5y ago
FWIW, if you wanted to get the static from-scratch go image a lot smaller, try running the binary through UPX. It typically improves compiled go binary sizes by absurd amounts: https://upx.github.io/ https://upx.github.io/
Also, https://busybox.net https://busybox.net is a 1.0MB static binary that provides all of the standard posix-compliant tools (sh, grep, tail, etc) and actually comes with an httpd implementation. So if you wanted a more useful container at about 1MB, you could use it.
Edit: here's a previous thread on UPX that has 80 comments talking about the tradeoffs it makes. You should definitely consider these if you intend to use UPX: https://news.ycombinator.com/item?id=15456980 https://news.ycombinator.com/item?id=15456980
- daniellockard 5y agoBe sure to check out the switches, --ultra-brute is what I usually use.
- codetrotter 5y agoBeware that at least historically some antivirus software would wrongly classify any UPX-packed binary as malware. Don’t know if this is still the case but something to keep in mind.
- account42 5y ago"some antivirus software would wrongly classify X as malware" is true for any X (except malware, then would not be wrong)
- fouc 5y ago1.0MB is quite large compared to 6.34kB :)
- whizzter 5y agoCertainly, I think this is more about getting over the developer pain threshold. In terms of computer speed vs human perception I don't see either one mattering too much (compared to a 900meg base for node-debian on Docker, although I guess there is some incremental stuff for that?).
- paulfurtado 5y agoIt definitely is, although a cool thing about busybox is that you can rebuild it with any applets disabled. I'm not sure just how small it can get though. But yeah, the tradeoff of that 1MB is that you get a very functional shell environment vs just an http server. It's impressive just how small ut is, given everything that it is capable of
- shakna 5y ago> It definitely is, although a cool thing about busybox is that you can rebuild it with any applets disabled. I'm not sure just how small it can get though. They do distribute statically linked individual binaries [0]. For just HTTPD and nothing else is about 85kb. But it is a lot more than just a static file server - it comes with CGI support. [0] https://www.busybox.net/downloads/binaries/1.30.0-i686/ https://www.busybox.net/downloads/binaries/1.30.0-i686/
- js8 5y ago> But yeah, the tradeoff of that 1MB is that you get a very functional shell environment vs just an http server. It's impressive just how small ut is, given everything that it is capable of Maybe.. I suspect a well-designed Forth image could pack similar capability in less than 100kB. So it might seem low, but not a miracle.
- TonyTrapp 5y agoKeep in mind that UPX needs to decompress the whole executable to memory and thus cannot make use of OS-level memory sharing. Normally, when you load the same executable twice, its base image will only consume memory once. But it with UPX, you cannot make use of that. So in the end, it may use more resources than you thought!
- paulfurtado 5y agoDefinitely important to note, I wonder if upx could solve this via execing an memfd_create in some mode. Also wish upx came with a trivial extraction tool so you could use it for distribution but not runtime.
- prova1 5y agook.
- mikepurvis 5y agoAren’t your container layers compressed in transit anyway?
- paulfurtado 5y agoUPX does significantly more compression on binaries than gzip can on the layers. It's not just simple compression, it makes a lot of modifications to the binary to make it more compressible.
- mikepurvis 5y agoPerhaps this is what you were asking for in the GP, but it would be interesting then if UPX could apply those transformations without actually doing the final compression step itself. Perhaps the win isn't as great without the ability to smuggle specific hints to the compressor, but it would be interesting to see. On the other hand, if it could be demonstrated that modest increases to binary size correlated to significantly improved compressability, then maybe that's something that should just be considered by the compilers themselves.
- okamiueru 5y agoI did exactly this a few years back. It added 18.5 kB on top of busybox, so, not as good as the 6kB ASM server code. With busybox included, the whole image is 1.18 MiB, or 751 kB compressed. If anyone cares to take a look: https://hub.docker.com/r/swalog/tiny-hello/ https://hub.docker.com/r/swalog/tiny-hello/
- prova1 5y agoholaa
- endgame 5y agoIf you only want the sh, you can get it even smaller. This doesn't UPX the busybox bin, though: $ ls -shL `nix-build -E '(import <nixpkgs> {}).pkgsCross.musl64.busybox.override { enableStatic = true; enableMinimal = true; }'`/bin/sh 128K /nix/store/qkq9cj81mcvnfr5y04jmf6nqvnrfg2z1-busybox-1.31.1-x86_64-unknown-linux-musl/bin/sh
- davidjfelix 5y agoIf you're going for size, why not just sidecar all of the "standard posix-compliant tools" but ones that you would want normally. For example, bash instead of ash/dash. You don't need those tools all the time right?
- dolmen 5y agoWell, you don't even need a shell.
- davidjfelix 5y agoI mostly meant to sidecar the shell and treat it as a debugging utility. While I get the point of ash being smaller as a point for busybox, if size stops being a concern because the shell is in an inactive-sidecar, then you can use a shell that has less surprising edge cases for users, like bash.
- dolmen 5y agoAbout busybox: if you want a small container, you don't need the posix tools at all, but just your binary. No shell.
- spalas 5y agoHi, author of the article here! I figured there were a bunch of ways to shrink that one, and I had a C based image that was in between my GO and ASM images, but decided to cut them for the sake of brevity!
- dnautics 5y agostealing vexu's routez: https://github.com/Vexu/routez https://github.com/Vexu/routez gives you a multiprocess http server in 612K uncompressed if you compile -Drelease-small