5 ms·

Canonical's 'distroless' Linux images are a game-changer for enterprises

55 points by CrankyBear 2y ago

johnea 2y ago
I don't see how this is "distroless". Clearaly, this is a Canonical distribution. Someone has to choose the exact combination of userland s/w to include with the kernel. Whoever/whatever chooses this s/w is creating a distribution. To this boomer yelling at the cloud, this is just more nonsensical hype, equivalent to "serverless".
superkuh 2y ago
I suppose now that they've containerized a huge amount of their repositories' userspace applications and they do much less work there (all pushed to upstream container makers) they can have those employees working to support other software than their open source OS. > Canonical plans to maintain the 2,000 widely used AI/ML libraries and tools, including heavy hitters such as PyTorch, TensorFlow, and Rapids, as source code instead of as Debian/Ubuntu deb packages. That's rough. Hopefully the desktop ecosystem doesn't suffer. That said, 12 years sounds amazing! I wish this were applied to their actual desktop LTE and ESM and not commercial docker container using non debian package management.
aster0id 2y ago
This actually sounds like an amazingly simple (at least in principle), and probably effective solution to a problem that does exist that I didn't realize needed to be solved.
- tguvot 2y ago
  https://www.fedramp.gov/assets/resources/documents/Vulnerability_Scanning_Requirements_for_Containers.pdf https://www.fedramp.gov/assets/resources/documents/Vulnerabi...
  - aster0id 2y ago
    This seems like a spec. Did you mean to say that there are similar products/services that already implement this?
    - tguvot 2y ago
      no. i am saying that this is actually a problem. especially for companies that need to implement certification like fedramp, which is very strict in areas of vulnerability management/keeping things updated/secured/hardened per specifications. (each individual cve vulnerability must be detected and remediated within specific timelines, based on it's severity) i am currently working on fedramp certification for a big system, and all requirements are serious pain in the ass to comply with, in case your organization not used to it
deleted 2y ago
[deleted]
jrm4 2y ago
Am as skeptical of this as I am of 'serverless' which also doesn't mean much and isn't true. What does this actually mean and why do they hide it behind a nonsensical term?
- mhio 2y ago
  I haven't seen ubuntu's version of distroless but the general term implies a container image with an empty shell of what a linux distro provides. Leaving behind only the minimum files for running your app rather than all the cruft around running and maintaining a distro, which is normally all done at container build time. From the Debian based https://github.com/GoogleContainerTools/distroless/blob/main/base/README.md https://github.com/GoogleContainerTools/distroless/blob/main... Statically compiled applications (Go) that do not require libc can use the gcr.io/distroless/static image, which contains: - ca-certificates - A /etc/passwd entry for a root user - A /tmp directory - tzdata Applications that require libc but do not need libssl can use the gcr.io/distroless/base-nossl, which contains all of the packages in gcr.io/distroless/static, and - glibc Most other applications (and Go apps that require libc/cgo) should start with gcr.io/distroless/base, which contains all of the packages in gcr.io/distroless/static, and - glibc - libssl
  - newman314 2y ago
    What I have found is that at least Google's distroless images do not get updated frequently enough to handle security issues. Because of this, I ended up switching to Ubuntu images and doing apt-get dist-upgrade before anything else to try to pick up fixed binaries. If Ubuntu truly is able to keep an up to date cadence for its distroless images, then I'd definitely want to investigate to see if I should switch.
    - lolinder 2y ago
      Looking at the dependency listing I'm trying to figure out why this would be. There are like 4 dependencies here in the largest of these containers, so why is it so difficult to keep them up to date?
ta8645 2y ago
They're offering to build custom container images, with the applications configured to customer specification? And the customer is free to host the resultant container on any OS / cloud provider of their choice. So it's a paid service, not a product?
TZubiri 2y ago
"Distroless docker image" We already have this from docker itself. https://hub.docker.com/_/scratch/ https://hub.docker.com/_/scratch/ I don't see how adding cannonical to our minimalist null distro adds any value. The idea of minimalism is to take away. What would they be doing anyway? Sounds like a corp just wanting to get in a business. Antithetical to the idea of removing everything but the kernel.
- never_inline 2y ago
  From scratch will not include CA certificates, timezone data etc.. which is necessary for some applications. Also Google has distroless images based on Debian for long time. Surely they have some use for it.
- wejick 2y ago
  It's basically canonical is moving towards image building supply chain ala bitnami. We get trusted source to base image building and support from canonical.
  - lostmsu 2y ago
    Where are the old bitnami images now?
- ghostly_s 2y ago
  Does Docker offer 12 years LTS?
  - _cenw 2y ago
    "scratch" is an empty image, so you technically get support forever
- orf 2y ago
  This isn’t a very useful comment. It’s about as useful as an empty container image by itself sure, it’s “distroless” and also has the fantastic property of having 0 security updates required forever, but surely you can see that the moment you add anything to it to yourself neither of those properties may apply.
Animats 2y ago
Is this the beginning of the end of free Ubuntu? Already, Canonical keeps pushing updates for "Ubuntu Pro".
- wejick 2y ago
  I don't think so. Ubuntu pro is support package offered by canonical, including longer LTS support until 10 years. So no, it's not Ubuntu becoming not free.
  - cpncrunch 2y ago
    Also, ubuntu pro is free if you have 5 or fewer servers.
    - traceroute66 2y ago
      > Also, ubuntu pro is free if you have 5 or fewer servers. Just worth pointing out that, its 5 free for PERSONAL (or your own business) use. "Free, personal subscription for 5 machines for you or any business you own" So if you're sysadmin'ing for someone else, pony up buttercup. :) P.S. ALSO read the small print. Virtual instance = Machine ("on up to five physical or virtual Ubuntu systems ")
      - cpncrunch 2y ago
        Yes, and I think that is a very reasonable policy overall. I was screwed by Centos when they suddenly dropped the support from Centos 8 and moved to Ubuntu. So far I've been very satisfied. Canonical has figured out that you can make money without screwing over your users.
- kelnos 2y ago
  I don't really get why Ubuntu is still popular. It was a wonderful idea at first, but has gone downhill quite a bit since then. Debian with the contrib and non-free dists enabled is plenty capable enough for most people, and then you don't have to deal with all of Ubuntu's and Canonical's baggage.
corytheboyd 2y ago
Do you really see that much of a runtime gain with scratch images (or distroless, same general idea) to justify using them? Not a criticism, I’m genuinely curious to hear from people experienced with both sides of this.
- hifromwork 2y ago
  Main goal of using distroless containers is increased security. Runtime gain is kind of a nice benefit you get for free. Security gains from distroless containers come in two flavours: * Reduced attack surface from some vectors, especially they make the container resistant against many common RCE exploits (almost all RCE attacks end up executing shell from the host, and shell is missing by design from distroless containers). Similarly, many in-container privilege escalation attacks are thwarted by this. * Drastically reduced numer of vulnerabilities reported by security scanners. This makes compliance people happy, even though it doesn't really increase security by itself.
- kevincox 2y ago
  The runtime gain is probably near zero. But there are a handful of advantages. 1. Smaller images. This reduces storage cost, pull time, setup time and can potentially allow more active images to be cached on your nodes. 2. Less installed means less for security scanners to trip on. Even if some software is unused it is good practice, and me be a compliance requirement to update with a fix. If it isn't installed there is no worry. 3. Simplicity. You know that things that aren't installed aren't causing issues. So tiny images can be easier to debug.
ungamedplayer 2y ago
If there is no distributed binaries, or executable files .. what exactly are they in the hook for supporting?
- tremon 2y ago
  Everything. From the actual horse's mouth [0]: > “Everything LTS means CVE maintenance for your entire open source dependency tree, including open source that is not already packaged as a deb in Ubuntu” said Mark Shuttleworth, CEO of Canonical The idea is that you just focus on producing the code and outsource the maintenance of the entire container image to Canonical. [0] https://canonical.com/blog/canonical-offers-12-year-lts-for-any-open-source-docker-image https://canonical.com/blog/canonical-offers-12-year-lts-for-...
gtirloni 2y ago
CrankyBear aka sjvn?
groodt 2y ago
Is this a response to Chainguard? https://www.chainguard.dev/ https://www.chainguard.dev/
kkfx 2y ago
Honestly? Is another way to quickly push crap in an infra, crap because you can't maintain nor know it enough, it will so stay for a looooong time, no one will know how to recreate it as needed, all will be done in hackish, quick and undocumented/untraceable ways and so on. Oh, I've no doubt some devs in Silicon Valley Mode and some managers will like it of course, as I've no doubt at a sudden point in future they'll regret. Ladies and gentleman's it's 2024, the era of containers MUST end for the sake of humanity, similarly to the previous full-stack virtualization on x86, it's about time to go declarative like NixOS/Guix System. The current typical infra is a big load of unmanageable, fragile crap with a so big attack surface that you have only to choose how to get TFU.
deleted 2y ago
[deleted]

55 points by CrankyBear 2y ago

I don't see how this is "distroless". Clearaly, this is a Canonical distribution. Someone has to choose the exact combination of userland s/w to include with the kernel. Whoever/whatever chooses this s/w is creating a distribution. To this boomer yelling at the cloud, this is just more nonsensical hype, equivalent to "serverless".

superkuh 2y ago

I suppose now that they've containerized a huge amount of their repositories' userspace applications and they do much less work there (all pushed to upstream container makers) they can have those employees working to support other software than their open source OS. > Canonical plans to maintain the 2,000 widely used AI/ML libraries and tools, including heavy hitters such as PyTorch, TensorFlow, and Rapids, as source code instead of as Debian/Ubuntu deb packages. That's rough. Hopefully the desktop ecosystem doesn't suffer. That said, 12 years sounds amazing! I wish this were applied to their actual desktop LTE and ESM and not commercial docker container using non debian package management.

aster0id 2y ago

This actually sounds like an amazingly simple (at least in principle), and probably effective solution to a problem that does exist that I didn't realize needed to be solved.

tguvot 2y ago
https://www.fedramp.gov/assets/resources/documents/Vulnerability_Scanning_Requirements_for_Containers.pdf https://www.fedramp.gov/assets/resources/documents/Vulnerabi...
- aster0id 2y ago
  This seems like a spec. Did you mean to say that there are similar products/services that already implement this?
  - tguvot 2y ago
    no. i am saying that this is actually a problem. especially for companies that need to implement certification like fedramp, which is very strict in areas of vulnerability management/keeping things updated/secured/hardened per specifications. (each individual cve vulnerability must be detected and remediated within specific timelines, based on it's severity) i am currently working on fedramp certification for a big system, and all requirements are serious pain in the ass to comply with, in case your organization not used to it

deleted 2y ago

[deleted]

jrm4 2y ago

Am as skeptical of this as I am of 'serverless' which also doesn't mean much and isn't true. What does this actually mean and why do they hide it behind a nonsensical term?

mhio 2y ago
I haven't seen ubuntu's version of distroless but the general term implies a container image with an empty shell of what a linux distro provides. Leaving behind only the minimum files for running your app rather than all the cruft around running and maintaining a distro, which is normally all done at container build time. From the Debian based https://github.com/GoogleContainerTools/distroless/blob/main/base/README.md https://github.com/GoogleContainerTools/distroless/blob/main... Statically compiled applications (Go) that do not require libc can use the gcr.io/distroless/static image, which contains: - ca-certificates - A /etc/passwd entry for a root user - A /tmp directory - tzdata Applications that require libc but do not need libssl can use the gcr.io/distroless/base-nossl, which contains all of the packages in gcr.io/distroless/static, and - glibc Most other applications (and Go apps that require libc/cgo) should start with gcr.io/distroless/base, which contains all of the packages in gcr.io/distroless/static, and - glibc - libssl
- newman314 2y ago
  What I have found is that at least Google's distroless images do not get updated frequently enough to handle security issues. Because of this, I ended up switching to Ubuntu images and doing apt-get dist-upgrade before anything else to try to pick up fixed binaries. If Ubuntu truly is able to keep an up to date cadence for its distroless images, then I'd definitely want to investigate to see if I should switch.
  - lolinder 2y ago
    Looking at the dependency listing I'm trying to figure out why this would be. There are like 4 dependencies here in the largest of these containers, so why is it so difficult to keep them up to date?

ta8645 2y ago

They're offering to build custom container images, with the applications configured to customer specification? And the customer is free to host the resultant container on any OS / cloud provider of their choice. So it's a paid service, not a product?

TZubiri 2y ago

"Distroless docker image" We already have this from docker itself. https://hub.docker.com/_/scratch/ https://hub.docker.com/_/scratch/ I don't see how adding cannonical to our minimalist null distro adds any value. The idea of minimalism is to take away. What would they be doing anyway? Sounds like a corp just wanting to get in a business. Antithetical to the idea of removing everything but the kernel.

never_inline 2y ago
From scratch will not include CA certificates, timezone data etc.. which is necessary for some applications. Also Google has distroless images based on Debian for long time. Surely they have some use for it.
wejick 2y ago
It's basically canonical is moving towards image building supply chain ala bitnami. We get trusted source to base image building and support from canonical.
- lostmsu 2y ago
  Where are the old bitnami images now?
ghostly_s 2y ago
Does Docker offer 12 years LTS?
- _cenw 2y ago
  "scratch" is an empty image, so you technically get support forever
orf 2y ago
This isn’t a very useful comment. It’s about as useful as an empty container image by itself sure, it’s “distroless” and also has the fantastic property of having 0 security updates required forever, but surely you can see that the moment you add anything to it to yourself neither of those properties may apply.

Animats 2y ago

Is this the beginning of the end of free Ubuntu? Already, Canonical keeps pushing updates for "Ubuntu Pro".

wejick 2y ago
I don't think so. Ubuntu pro is support package offered by canonical, including longer LTS support until 10 years. So no, it's not Ubuntu becoming not free.
- cpncrunch 2y ago
  Also, ubuntu pro is free if you have 5 or fewer servers.
  - traceroute66 2y ago
    > Also, ubuntu pro is free if you have 5 or fewer servers. Just worth pointing out that, its 5 free for PERSONAL (or your own business) use. "Free, personal subscription for 5 machines for you or any business you own" So if you're sysadmin'ing for someone else, pony up buttercup. :) P.S. ALSO read the small print. Virtual instance = Machine ("on up to five physical or virtual Ubuntu systems ")
    - cpncrunch 2y ago
      Yes, and I think that is a very reasonable policy overall. I was screwed by Centos when they suddenly dropped the support from Centos 8 and moved to Ubuntu. So far I've been very satisfied. Canonical has figured out that you can make money without screwing over your users.
kelnos 2y ago
I don't really get why Ubuntu is still popular. It was a wonderful idea at first, but has gone downhill quite a bit since then. Debian with the contrib and non-free dists enabled is plenty capable enough for most people, and then you don't have to deal with all of Ubuntu's and Canonical's baggage.

corytheboyd 2y ago

Do you really see that much of a runtime gain with scratch images (or distroless, same general idea) to justify using them? Not a criticism, I’m genuinely curious to hear from people experienced with both sides of this.

hifromwork 2y ago
Main goal of using distroless containers is increased security. Runtime gain is kind of a nice benefit you get for free. Security gains from distroless containers come in two flavours: * Reduced attack surface from some vectors, especially they make the container resistant against many common RCE exploits (almost all RCE attacks end up executing shell from the host, and shell is missing by design from distroless containers). Similarly, many in-container privilege escalation attacks are thwarted by this. * Drastically reduced numer of vulnerabilities reported by security scanners. This makes compliance people happy, even though it doesn't really increase security by itself.
kevincox 2y ago
The runtime gain is probably near zero. But there are a handful of advantages. 1. Smaller images. This reduces storage cost, pull time, setup time and can potentially allow more active images to be cached on your nodes. 2. Less installed means less for security scanners to trip on. Even if some software is unused it is good practice, and me be a compliance requirement to update with a fix. If it isn't installed there is no worry. 3. Simplicity. You know that things that aren't installed aren't causing issues. So tiny images can be easier to debug.

ungamedplayer 2y ago

If there is no distributed binaries, or executable files .. what exactly are they in the hook for supporting?

tremon 2y ago
Everything. From the actual horse's mouth [0]: > “Everything LTS means CVE maintenance for your entire open source dependency tree, including open source that is not already packaged as a deb in Ubuntu” said Mark Shuttleworth, CEO of Canonical The idea is that you just focus on producing the code and outsource the maintenance of the entire container image to Canonical. [0] https://canonical.com/blog/canonical-offers-12-year-lts-for-any-open-source-docker-image https://canonical.com/blog/canonical-offers-12-year-lts-for-...

gtirloni 2y ago

CrankyBear aka sjvn?

groodt 2y ago

Is this a response to Chainguard? https://www.chainguard.dev/ https://www.chainguard.dev/

kkfx 2y ago

Honestly? Is another way to quickly push crap in an infra, crap because you can't maintain nor know it enough, it will so stay for a looooong time, no one will know how to recreate it as needed, all will be done in hackish, quick and undocumented/untraceable ways and so on. Oh, I've no doubt some devs in Silicon Valley Mode and some managers will like it of course, as I've no doubt at a sudden point in future they'll regret. Ladies and gentleman's it's 2024, the era of containers MUST end for the sake of humanity, similarly to the previous full-stack virtualization on x86, it's about time to go declarative like NixOS/Guix System. The current typical infra is a big load of unmanageable, fragile crap with a so big attack surface that you have only to choose how to get TFU.

deleted 2y ago

[deleted]