4 ms·

Am as skeptical of this as I am of 'serverless' which also doesn't mean much and isn't true. What does this actually mean and why do they hide it behind a nons

by jrm4 2y ago

Am as skeptical of this as I am of 'serverless' which also doesn't mean much and isn't true. What does this actually mean and why do they hide it behind a nonsensical term?

mhio 2y ago
I haven't seen ubuntu's version of distroless but the general term implies a container image with an empty shell of what a linux distro provides. Leaving behind only the minimum files for running your app rather than all the cruft around running and maintaining a distro, which is normally all done at container build time. From the Debian based https://github.com/GoogleContainerTools/distroless/blob/main/base/README.md https://github.com/GoogleContainerTools/distroless/blob/main... Statically compiled applications (Go) that do not require libc can use the gcr.io/distroless/static image, which contains: - ca-certificates - A /etc/passwd entry for a root user - A /tmp directory - tzdata Applications that require libc but do not need libssl can use the gcr.io/distroless/base-nossl, which contains all of the packages in gcr.io/distroless/static, and - glibc Most other applications (and Go apps that require libc/cgo) should start with gcr.io/distroless/base, which contains all of the packages in gcr.io/distroless/static, and - glibc - libssl
- newman314 2y ago
  What I have found is that at least Google's distroless images do not get updated frequently enough to handle security issues. Because of this, I ended up switching to Ubuntu images and doing apt-get dist-upgrade before anything else to try to pick up fixed binaries. If Ubuntu truly is able to keep an up to date cadence for its distroless images, then I'd definitely want to investigate to see if I should switch.
  - lolinder 2y ago
    Looking at the dependency listing I'm trying to figure out why this would be. There are like 4 dependencies here in the largest of these containers, so why is it so difficult to keep them up to date?
    - mhio 2y ago
      The issues I've seen are around updating the run times to point to new release versions in a timely manner. The project maintainers don't actively work on (the endless) security updates and defer people to commercial projects that can spend the time doing that.
  - lokar 2y ago
    The images are tiny, and trivial to update. You don’t really need theirs, just take the bazel rules and build it yourself.
  - laz 2y ago
    I'm using rules_distroless+rules_oci with bazel to build small Ubuntu based images. It takes some effort, but ends up being pretty nice.
eirik_ 2y ago
They are not hiding behind a non sensical term. Distroless is a established term in the container space. Many images are often offered in both "normal" and "distroless" flavor, where distroless is stripped of anything that is not needed to run the application, for example curl and shells etc. Since distroless are lacking all these tools other techniques needs to be used during troubleshooting and debugging. I think distroless images are great. Less stuff to patch and smaller images.
- persnickety 2y ago
  A term can be both established and nonsensical, like grandparent's "serverless". It doesn't make sense in multiple ways. "Distro" means "distribution", so "something that is distributed". Aren't "distroless" images being widely distributed? It seems that "distroless" images are being built from a distribution, and then by removing some of the contents. So you must have a distro first, otherwise you can't have "distroless". That doesn't add up semantically.
  - blackoil 2y ago
    Words can have different meaning than its etymological parents. If I seed Ubuntu it doesn't become blckoil distro. So the word distro means different from distribution.
    - makeitdouble 2y ago
      The issue is you could make and maintain a blckoil distro tomorrow that only keeps the bare minimum to run a go application. It would be bit for bit the same as the "distroless" version, except it will be a distro.
  - solatic 2y ago
    The "something that is distributed" is a package manager and package repositories. What makes a distribution is what choices it makes in letting you install software. A distroless image doesn't include a package manager. You cannot use anything in the provided distroless image to install software.
__MatrixMan__ 2y ago
It means that your containers only have what you explicitly put there. There's none of the niceties that the distro's typically include. It means you have to stop treating your containers a little less like VM's and start treating them a bit more like OS processes. For instance, you can't get a shell on one unless you bother installing that shell yourself.
- metadat 2y ago
  How would you install a shell without a package manager? Edit: @mhio That's what I suspected, thank you.
  - dralley 2y ago
    I assume the images are pre built based on a manifest provided by the developer. The developer decides whether or not to include a shell and which shell to include.
    - metadat 2y ago
      What are these manifests? I presume you are correct - the images are prebuilt (as typical for docker), but then it's like coreos, what you get is whatever you `docker pull'ed, most likely very basic (by design). Great in cases where the app is a self-contained Go program only requiring libc, but not useful when you need to apt/yum/dnf install anything.
  - mhio 2y ago
    You don't. There are tools like `nsenter` to act on the container namespaces. https://manpages.debian.org/bookworm/util-linux/nsenter.1.en.html https://manpages.debian.org/bookworm/util-linux/nsenter.1.en...
    - deleted 2y ago
      [deleted]
- idontwantthis 2y ago
wejick 2y ago
Think in the way that even without kernel and toolkit, many deployments still need libraries and frameworks. Like python deployment needs python runtime, AI deployment needs Python and pyTorch. Canonical will support that. It's actually make sense as you don't need package manager or other things (basically distro toolkit) to build and run container image.

by jrm4 2y ago

Am as skeptical of this as I am of 'serverless' which also doesn't mean much and isn't true. What does this actually mean and why do they hide it behind a nonsensical term?

mhio 2y ago

I haven't seen ubuntu's version of distroless but the general term implies a container image with an empty shell of what a linux distro provides. Leaving behind only the minimum files for running your app rather than all the cruft around running and maintaining a distro, which is normally all done at container build time. From the Debian based https://github.com/GoogleContainerTools/distroless/blob/main/base/README.md https://github.com/GoogleContainerTools/distroless/blob/main... Statically compiled applications (Go) that do not require libc can use the gcr.io/distroless/static image, which contains: - ca-certificates - A /etc/passwd entry for a root user - A /tmp directory - tzdata Applications that require libc but do not need libssl can use the gcr.io/distroless/base-nossl, which contains all of the packages in gcr.io/distroless/static, and - glibc Most other applications (and Go apps that require libc/cgo) should start with gcr.io/distroless/base, which contains all of the packages in gcr.io/distroless/static, and - glibc - libssl

newman314 2y ago
What I have found is that at least Google's distroless images do not get updated frequently enough to handle security issues. Because of this, I ended up switching to Ubuntu images and doing apt-get dist-upgrade before anything else to try to pick up fixed binaries. If Ubuntu truly is able to keep an up to date cadence for its distroless images, then I'd definitely want to investigate to see if I should switch.
- lolinder 2y ago
  Looking at the dependency listing I'm trying to figure out why this would be. There are like 4 dependencies here in the largest of these containers, so why is it so difficult to keep them up to date?
  - mhio 2y ago
    The issues I've seen are around updating the run times to point to new release versions in a timely manner. The project maintainers don't actively work on (the endless) security updates and defer people to commercial projects that can spend the time doing that.
- lokar 2y ago
  The images are tiny, and trivial to update. You don’t really need theirs, just take the bazel rules and build it yourself.
- laz 2y ago
  I'm using rules_distroless+rules_oci with bazel to build small Ubuntu based images. It takes some effort, but ends up being pretty nice.

eirik_ 2y ago

They are not hiding behind a non sensical term. Distroless is a established term in the container space. Many images are often offered in both "normal" and "distroless" flavor, where distroless is stripped of anything that is not needed to run the application, for example curl and shells etc. Since distroless are lacking all these tools other techniques needs to be used during troubleshooting and debugging. I think distroless images are great. Less stuff to patch and smaller images.

persnickety 2y ago
A term can be both established and nonsensical, like grandparent's "serverless". It doesn't make sense in multiple ways. "Distro" means "distribution", so "something that is distributed". Aren't "distroless" images being widely distributed? It seems that "distroless" images are being built from a distribution, and then by removing some of the contents. So you must have a distro first, otherwise you can't have "distroless". That doesn't add up semantically.
- blackoil 2y ago
  Words can have different meaning than its etymological parents. If I seed Ubuntu it doesn't become blckoil distro. So the word distro means different from distribution.
  - makeitdouble 2y ago
    The issue is you could make and maintain a blckoil distro tomorrow that only keeps the bare minimum to run a go application. It would be bit for bit the same as the "distroless" version, except it will be a distro.
- solatic 2y ago
  The "something that is distributed" is a package manager and package repositories. What makes a distribution is what choices it makes in letting you install software. A distroless image doesn't include a package manager. You cannot use anything in the provided distroless image to install software.

__MatrixMan__ 2y ago

It means that your containers only have what you explicitly put there. There's none of the niceties that the distro's typically include. It means you have to stop treating your containers a little less like VM's and start treating them a bit more like OS processes. For instance, you can't get a shell on one unless you bother installing that shell yourself.

metadat 2y ago
How would you install a shell without a package manager? Edit: @mhio That's what I suspected, thank you.
- dralley 2y ago
  I assume the images are pre built based on a manifest provided by the developer. The developer decides whether or not to include a shell and which shell to include.
  - metadat 2y ago
    What are these manifests? I presume you are correct - the images are prebuilt (as typical for docker), but then it's like coreos, what you get is whatever you `docker pull'ed, most likely very basic (by design). Great in cases where the app is a self-contained Go program only requiring libc, but not useful when you need to apt/yum/dnf install anything.
- mhio 2y ago
  You don't. There are tools like `nsenter` to act on the container namespaces. https://manpages.debian.org/bookworm/util-linux/nsenter.1.en.html https://manpages.debian.org/bookworm/util-linux/nsenter.1.en...
  - deleted 2y ago
    [deleted]
idontwantthis 2y ago

wejick 2y ago

Think in the way that even without kernel and toolkit, many deployments still need libraries and frameworks. Like python deployment needs python runtime, AI deployment needs Python and pyTorch. Canonical will support that. It's actually make sense as you don't need package manager or other things (basically distro toolkit) to build and run container image.