4 ms·

Also all those dependencies are security risks. A lot quicker and easier to scan a container with just one go executable than even the most benign distribution

Also all those dependencies are security risks. A lot quicker and easier to scan a container with just one go executable than even the most benign distribution of core utils and so on. And if your containers are just one binary and you can read the logs then you don’t need to go into the container any more than you need to go into your binary. Then your k8s node or other container runner host is just like your old host running a bunch of processes but with much better process isolation and file system isolation.

blowski 6y ago
There are some teams where this will be the best use of their time, and I'd be well out of my depth suggesting to them otherwise. But the vast majority of teams in my experience have spent ages farting around with these kind of micro-optmisations, whilst there were far better opportunities to improve the infrastructure. And in the process, they actually made it more fragile and harder to debug. Simply put, this is a niche skill with niche value. Most people trying to do this probably can't and shouldn't do it.