3 ms·

Haven't heard of those. Can you tell me more?

• sofixa 3y ago
  Basically instead of FROM python:3.9, you do FROM scratch. This represents an empty container with nothing. It's quite easy to use with statically compiled languages, and a bit less so with interpreted ones like Python, but you need to use a multi-step build with first an image containing your dependencies to compile, and then a stage from scratch copying just the resulting artifacts. That way your production image is extremely light and has no attack surface or stuff to update outside of your own code. The main downside is that debugging live is not easy (if you have some networking errors, you can't just exec inside and do some ping/curl/netstat/etc. to check stuff, because you can't even exec inside due to no shell being present), and requires extra tooling like cntr/cdebug or Kubernetes Ephemeral Containers which will attach a fuller container (e.g. busybox) to the running scratch one to be able to debug. https://chemidy.medium.com/create-the-smallest-and-secured-golang-docker-image-based-on-scratch-4752223b7324 https://chemidy.medium.com/create-the-smallest-and-secured-g... https://medium.com/analytics-vidhya/dockerizing-a-rest-api-in-python-less-than-9-mb-and-based-on-scratch-image-ef0ee3ad3f0a https://medium.com/analytics-vidhya/dockerizing-a-rest-api-i...