4 ms·

> You throw your script/container If you're using containers, then IMO, you're no longer serverless. The reason being... > Nothing to maintain or update outs

> You throw your script/container If you're using containers, then IMO, you're no longer serverless. The reason being... > Nothing to maintain or update outside of your own code Unless your Dockerfile uses something like "FROM python:latest", you'll find yourself having to update your Dockerfile to pull in new images on a regular basis in order to get the latest package updates. People usually like to have reproducible builds though, so will instead use something like "FROM:python:3.7.16-alpine3.18". Except, sorry, that's out of date now. You need to update to "python:3.7.17-alpine3.18."

sofixa 3y ago
That's where scratch containers come in.
- Sohcahtoa82 3y ago
  Haven't heard of those. Can you tell me more?
  - sofixa 3y ago
    Basically instead of FROM python:3.9, you do FROM scratch. This represents an empty container with nothing. It's quite easy to use with statically compiled languages, and a bit less so with interpreted ones like Python, but you need to use a multi-step build with first an image containing your dependencies to compile, and then a stage from scratch copying just the resulting artifacts. That way your production image is extremely light and has no attack surface or stuff to update outside of your own code. The main downside is that debugging live is not easy (if you have some networking errors, you can't just exec inside and do some ping/curl/netstat/etc. to check stuff, because you can't even exec inside due to no shell being present), and requires extra tooling like cntr/cdebug or Kubernetes Ephemeral Containers which will attach a fuller container (e.g. busybox) to the running scratch one to be able to debug. https://chemidy.medium.com/create-the-smallest-and-secured-golang-docker-image-based-on-scratch-4752223b7324 https://chemidy.medium.com/create-the-smallest-and-secured-g... https://medium.com/analytics-vidhya/dockerizing-a-rest-api-in-python-less-than-9-mb-and-based-on-scratch-image-ef0ee3ad3f0a https://medium.com/analytics-vidhya/dockerizing-a-rest-api-i...

sofixa 3y ago

That's where scratch containers come in.

Sohcahtoa82 3y ago
Haven't heard of those. Can you tell me more?
- sofixa 3y ago
  Basically instead of FROM python:3.9, you do FROM scratch. This represents an empty container with nothing. It's quite easy to use with statically compiled languages, and a bit less so with interpreted ones like Python, but you need to use a multi-step build with first an image containing your dependencies to compile, and then a stage from scratch copying just the resulting artifacts. That way your production image is extremely light and has no attack surface or stuff to update outside of your own code. The main downside is that debugging live is not easy (if you have some networking errors, you can't just exec inside and do some ping/curl/netstat/etc. to check stuff, because you can't even exec inside due to no shell being present), and requires extra tooling like cntr/cdebug or Kubernetes Ephemeral Containers which will attach a fuller container (e.g. busybox) to the running scratch one to be able to debug. https://chemidy.medium.com/create-the-smallest-and-secured-golang-docker-image-based-on-scratch-4752223b7324 https://chemidy.medium.com/create-the-smallest-and-secured-g... https://medium.com/analytics-vidhya/dockerizing-a-rest-api-in-python-less-than-9-mb-and-based-on-scratch-image-ef0ee3ad3f0a https://medium.com/analytics-vidhya/dockerizing-a-rest-api-i...