3 ms·

That's why the best option is scratch containers, they have pretty much nothing outside of the stuff you add in manually (like your binaries).

by sofixa 3y ago

hinkley 3y ago
I’m not fucking around with a container that doesn’t have a package manager in it. apk does a pretty good job of not being populated with hot garbage.
- dharmab 3y ago
  Generally with scratch images you build in a less weird environment, then copy your application's files into a scratch image. https://docs.docker.com/build/guide/multi-stage/ https://docs.docker.com/build/guide/multi-stage/
- sofixa 3y ago
  You don't need a package manager in your production container, you need one for the dependencies to build your artifact (in previous stages) which gets passed on, on it's own, statically compiled, to the empty container.
  - hinkley 3y ago
    And I need a tool chain for inspecting a sick container trying to figure out why CPU jumped 25% for no apparent reason. Also some programming languages, you can’t really populate the app’s dependencies without a bunch of its dependencies. And the only way to split the difference means you have to memorize every file that gets created during the build/install process to be sure you don’t miss anything airlifting them from one container to another. All of which amounts to me becoming the package manager. Which gets much less fun the more containers you have running in prod. I generally respect the curation that alpine does. Not too old, not too bleeding edge.
    - dharmab 3y ago
      > And I need a tool chain for inspecting a sick container trying to figure out why CPU jumped 25% for no apparent reason. You can attach a debugging container with your tools temporarily: https://kubernetes.io/docs/concepts/workloads/pods/ephemeral-containers/ https://kubernetes.io/docs/concepts/workloads/pods/ephemeral...

3 ms·

That's why the best option is scratch containers, they have pretty much nothing outside of the stuff you add in manually (like your binaries).

by sofixa 3y ago

That's why the best option is scratch containers, they have pretty much nothing outside of the stuff you add in manually (like your binaries).

hinkley 3y ago
I’m not fucking around with a container that doesn’t have a package manager in it. apk does a pretty good job of not being populated with hot garbage.
- dharmab 3y ago
  Generally with scratch images you build in a less weird environment, then copy your application's files into a scratch image. https://docs.docker.com/build/guide/multi-stage/ https://docs.docker.com/build/guide/multi-stage/
- sofixa 3y ago
  You don't need a package manager in your production container, you need one for the dependencies to build your artifact (in previous stages) which gets passed on, on it's own, statically compiled, to the empty container.
  - hinkley 3y ago
    And I need a tool chain for inspecting a sick container trying to figure out why CPU jumped 25% for no apparent reason. Also some programming languages, you can’t really populate the app’s dependencies without a bunch of its dependencies. And the only way to split the difference means you have to memorize every file that gets created during the build/install process to be sure you don’t miss anything airlifting them from one container to another. All of which amounts to me becoming the package manager. Which gets much less fun the more containers you have running in prod. I generally respect the curation that alpine does. Not too old, not too bleeding edge.
    - dharmab 3y ago
      > And I need a tool chain for inspecting a sick container trying to figure out why CPU jumped 25% for no apparent reason. You can attach a debugging container with your tools temporarily: https://kubernetes.io/docs/concepts/workloads/pods/ephemeral-containers/ https://kubernetes.io/docs/concepts/workloads/pods/ephemeral...