distroless

alorizes VMs. Which have far far more of a bucket of bits what-is-all-this-nonsense problem, that requires providing far more scripting, tailoring, configuration make. Unless you are running bootc or zerg or unikernel stuff, it feels like VM'ers are in in no moral position to look down on containers, my heavens! This article has a couple little gems in it here & there. You call it short, but it's just short on understanding thought concern and perspective. It wrings the same blood from the stone again and again and again. Complexity bad, Kubernetes complex, this is garbage, again and again and again. Without really having much to say, just inferring, just trying to condescend you into belief. But there are a couple little good gems here & there (pro CORBA?! Wasm/wasi hype...)

o creating full virtual machines. That’s it. Generously, this is written by an ignorant idiot: best case. Its hard to credit the AI/person even ignorance. Seems everyone in the last 5 years at least oughtta be damned well aware that containers have pretty real advantages versus VMs. Just talking purely about how your machine runs VMs vs containers, there's so many wins. Considerably less CPU & latency overhead because you only need to run one kernel, rather than dozens or hundreds which are all trying to schedule but which don't actually have scheduling authority. And that one kernel can allocate memory more efficiently and potentially share page cache across images, radically improving both memory and cache utilization. Manageability is so much better. There are probably some attempts out there for base VMs, but a full OS tends to have a lot of corp config and twiddling. Where-as you can grab a node or python or whatever base image, built on a nice slim OS or distroless (no starter required but https://github.com/GoogleContainerTools/distroless is a resource), and add just a little more of your stuff on top. The profile of what needs to be managed with containers is much much much less; the host and your container runtime provide much of what a VM would need configured on it. It's stunning to find this variety of simple uninformed rage bait, that didn't pass muster 5 years ago! Yes, the convenience of layers pulling in what you want is high. But that's 1. Good and 2. Also backed by many significant technical wins vs VMs. > From this fundamentally broken concept of componentization, we’ve constructed the entire Kubernetes ecosystem, which exists primarily to solve the problem of managing these semantically meaningless horrors by aggregating all possible kinds of digital garbage into something that resembles a functioning system. Like, alas, yes maybe? Actually running modern services requires an amalgamation of more than just code. Maybe we are just talking about the container itself, in which case this is absurd. You can fill a container up with whatever. I think VM's are much worse bucket of bit problems, usually without simple Dockerfiles to explain themselves. The container can be extremely minimal, again, as Distroless shows. Containers feel far less of an offense than what happens with modern package management, which companies typically just don't do a good job of at all. But more generously I think we take this snipe as a bigger view, about Kubernetes breadth and scope and all the other pieces. And there, it is a ridiculously preposterously one sized critique, that 100% is locked on to the thing developers are closest to (code) and which ignores everything else that's cloud. Perhaps yes there are better ways to send code to systems. Perhaps this is far more complex than what you'd want to send up code. But what makes Kubernetes popular and different from the many "ways to run code" whose corpses decay along the path of history is that none of them provided much other than code. I talked about what containers provide versus needing to configure VMs, and that goes 5x for Kubernetes. You can pass in secrets, pass in your various aws resources with ACK, pass in databases from psotgres-operator, pass in storage, pass in fancy networking with multus, now with new Kube you can pass on GPUs. Kube provides. It's like dependency injection for computing (rather than code) at large. Your manifest asks for some stuff it needs, and the platform makes it available. This is such a powerful distinguishing advancement over where we were. And it's so extensible, so readily able to model and provide such an endless variety of manageability across the whole breadth of cloud stuff. Cloud stuff that is in no way unique to Kubernetes. This criticism isn't against Kubernetes, it's against system design that depends on anything, it's criticism that hates CloudFormation and Terraform at least as bitterly for daring to let your service have dependencies. > Deploying a system on Kubernetes is always a nightmare of managing a collection of unhinged components that can explode at any moment for any reason. So is the real world. So is running things. Having a consistent place where everything is managed via similar tools is a great relief, versus every system blowing up in its own way. Versus every dependency having its own bespoke operational paradigm. And it heals so much better! Kubernetes's biggest problem is that it's so damned autonomic, it self heals so well, that we never even have to get the intimate gory bloody experience we had to claw through. Teams aren't setting up their own postgres HA and backup and replication by hand, over multiple sprints. They pull down a very professional very tested operator, and the controller works, it operates the cluster across a huge range of failures incredibly well. We are bad at debugging and understanding Kubernetes because it mostly works extremely fantastically robustly and well without us. > How do we create software components for distributed computing that can be easily deployed in the cloud? And, > And here’s the kicker: universal components that work across all languages already exist. Look at WASI (WebAssembly System Interface), components built on WebAssembly that provide a platform-independent, efficient format that any language can compile to. I talked to this some. I too have huge hopes in WASI. I want that future so so bad. But it's not here yet (in any meanginfully usable async fashion), and it's speculative that it's all going to work well someday (fingers very crossed, I want it). Watch a Luke Wagner talk and get hype, get involved, find out! https://youtu.be/W3f8AAte0LM But even when WASI is here, i 100% am going to be using wasmCloud (or something else) to manage WebAssembly runtimes, doing more and more, on Kubernetes, using the storage, config, networking, and secret primitives provided by the base Kubernetes platform, using other services like postgres and nats and redis, which are managed by very good very professional Kubernetes controllers. The paradigm of Kubernetes brings incredible clarity to help us manage the sea of things. In an miraculously-extensible cross type-of-thing way we have never enjoyed the luxury of before. With a paradigm of reliability we've rarely enjoyed. Wasm will do a lot, but it's just code. We still ought want & be working on management layers. There's so much value to the powerful platform providing world Kubernetes advanced us towards, that containers advanced us beyond VMs with. Looking forward to more. Loving seeing the managed stuff. The symptom is that the world is complex. Eliminating or never going to settled agriculture would have resulted in none of these problems happening. But that's not the sort of solution we really want, that lets us do amazing things, that creates a mature capable world. We have to straddle and cope with complexity, and simply retreating from it and calling it bad like this article does again and again is such a retro-naivety that so darkly refuses to acknowledge that while complexity sometimes hurts, while we say we want simplicity, we have to also balance that we are an advanced civilization & we want the nice things that advanced civilizations come with, and that simply pop poo-ing and scouring the complexity, while hip and edgy, isn't an sufficient practical or coherent line of thought that merits giving up like that. On we go.

at require libc/cgo) should start with gcr.io/distroless/base, which contains all of the packages in gcr.io/distroless/static, and - glibc - libssl

e is to do some python, then you can pull a python image that has the proper release.

ave to rely on upstream to cut a release. Chainguard will be doing that, with lots of automation & guardrails in placed. This allow them to fix vulnerabilties extremely fast. Why go through all the analysis, etc.. where you can patch it very quickly. 2. The OS is glibc-based. Which is a lot more friendly than Alpine. 3. It's pretty much YAML which is kinda easy to package software into APK packages & then images (with apko) 4. SBOM and a lot more. But that's stuff on top of my head.