distroless

> people are using them for their dev environments [?] Yes, we use a container for dev environment so that we can share the same env across all the team. If it's decided that we need 1 more tool in our toolbox, the script that generates the container is updated (the script is version controlled in the repo too), the CI/CD generates a new container version, all the devs can now use the same NEW environment. We actually use the container as image for (remote) virtual machines, so we don't really compose multiple containers. The container has all the tools (for several languages) that we use as a team. IDEs and debuggers can connect through ssh. > post-development workflow do you ever use separate containers for build and test? We build different flavors of the final packaged application, for example: - production flavor: uses a minimal, non

An alternative is a multi step build, then running with Google’s Distroless https://github.com/GoogleContainerTools/distroless

Scratch is blank. Distroless includes some Debian components that removes a bunch of "gotchas" that some people relying on scratch run into. static has: ca-certificates, /etc/passwd, /tmp directory, tzdata base has: glibc, libssl, openssl https://github.com/GoogleContainerTools/distroless/tree/main...

distroless static (the smallest one, https://github.com/GoogleContainerTools/distroless/tree/main...) is about 4 MB. It contains things like: /usr/share/zoneinfo/<timezones> /etc/ssl/certs/ca-certificates.crt /etc/debian_version ... not much else really. On the other hand, scratch is a special image that contains literally nothing, 0 bytes. Docker doesn't have to talk to the network to download it, it doesn't have to be built, it's just a tarball of nothing. scratch is thus infinitely smaller than distroless since it has no size. It's also not suitable for rust since rust applications will commonly link against openssl for tls, against a libc implementation for things like network operations and threads, and so on.

See: Distroless images[0] This is one of the huge benefits of recent systems languages like go and rust -- they compile to single binaries so you can use things like scatch[1] containers. You may have to fiddle with gnu libc/musl libc (usually when getaddrinfo is involved/dns etc), but once you're done with it, packaging is so easy. Even languages like Node (IMO the most progressive of the scripting languages) have packages like vercel/pkg[2] which produce native binaries. BTW if you're considering running redis these days... Check out KeyDB[3], it's impressive. There are a lot of redis alternatives with interesting features these days that I wonder if running vanilla redis is even a good idea anymore (outside of ensuring complete feature-set compatibility). [0]: https://github.com/GoogleContainerTools/distroless [1]: https://hub.docker.c

Unikernel is what you're interested in, but it's not as easy as taking some Linux-based server software and spitting out a bootable image for baremetal. If you strip the kernel and OS out you lose the network stack and all kinds of system services that most software depends on directly. I think Google's distroless container images are worth checking out as a quasi-alternative: https://github.com/GoogleContainerTools/distroless You use them as a base for a docker image and copy in your server code. These images are tailor made to strip out _everything_ that's not necessary to run the software--there's no shell for example. So you're still running a Linux kernel, libc, etc. but there's nothing there for an attacker to use other than your app code. You yourself can't even get into a shell to debug or examine what the state of your app i

In my experience docker-slim[0] is the way to go for creating minimal and secure Docker images. I wasted a lot of time in the past trying to ship with Alpine base images and statically compiling complicated software. All the performance, compatibility, package availability headaches this brings is not worth it when docker-slim does a better job of removing OS from your images while letting you use any base image you want. Tradeoff is that you give up image layering to some extent and it might take a while to get dead-file-elimination exactly right if your software loads a lot of files dynamically (you can instruct docker-slim to include certain paths and probe your executable during build). If docker-slim is not your thing, “distroless” base images [1] are also pretty good. You can do your build with the same distro and then in a multi st

Google's debian-based distroless is fascinating: https://github.com/GoogleContainerTools/distroless

https://github.com/GoogleContainerTools/distroless This is the container community’s response to this ambiguity I think.

If you decouple you build from your packaging you can also use from-scratch containers. You can also use distroless' static image [0] to get a posix-y environment with as little space as possible. Total image size of the static image is ~2.4mb and it comes with a `nonroot` user configured to lock down your perms and packages like ca-certs that are often forgotten. You can make use of this with multistage builds or with build systems like Bazel and Please.build. [0] - https://github.com/GoogleContainerTools/distroless/blob/main...

Why don't more people use distroless? Based on debian so no musl headaches but even lighter than alpine https://github.com/GoogleContainerTools/distroless

It's no accident that the Google Open Source Security Team is sponsor of reproducible-builds.org: they'd like to get the open source world up to speed with best practices that have been applied widely internally at Google for well over a decade. Blaze (a.k.a. Bazel) rolled out at Google around 2007-ish, and the idea that consistent inputs should produce consistent outputs was fundamental to its philosophy. Build rules like https://github.com/GoogleContainerTools/distroless to create minimal, reproducible docker images would seem radical and new most people building docker containers these days (almost everyone uses Dockerfile format) but it'd seem perfectly ordinary and very old-fashioned to any Googler.

If you're a fan of this approach to deploying applications and use docker, distroless [1] is a really cool project related to this. It uses debian as the base and supports cgo because it has glibc (and openssl) [1]: https://github.com/GoogleContainerTools/distroless

For Java, JIB on distroless works pretty well. It's small, fast and secure. - https://github.com/GoogleContainerTools/jib - https://github.com/GoogleContainerTools/distroless

One way to simply optimize Docker image size is to use https://github.com/GoogleContainerTools/distroless Supports Go, Python, Java, out of the box.