Build distroless package for better security, smaller size, speed and more
@imaffe is already working on this.
Since Oct 24, 2022.
Assessment
This issue has not been assessed yet.
Description
As proofed in practice and documented in https://github.com/streamnative/function-mesh/issues/371
there are sometimes (often!) security problems in a container/package whose origin is not the software one build, but in the software which is also situated in this container.
In most cases, there is no use case for this additional software.
This is where the idea of distroless containers comes in and "free" your software:
- for better security
- fewer bugs
- smaller packages
- a faster build process
- a faster check process (e.g. security scans for CVEs and CWEs)
- faster, cheaper and less annoying development process, because of less noise to understand and fix
- faster spin-up / faster dynamic scaling on load
- less demanding for needed infrastructure = less cost for infrastructure to run on
- ...
Traditional, this approach is somehow strenuous to implement and associated with restrictions.
But it looks like 2 new tools makes it pretty easy and straight forward:
good overview on distroless containers
https://dev.to/dansiviter/distroless-alpine-ci8
and
https://blog.chainguard.dev/minimal-container-images-towards-a-more-secure-future/
see last paragraph for how it works
the tools:
source to abk:
https://github.com/chainguard-dev/melange
abk to oci:
https://github.com/chainguard-dev/apko
to debug distroless containers:
official: https://kubernetes.io/docs/concepts/workloads/pods/ephemeral-containers/
detail flow: https://iximiuz.com/en/posts/kubernetes-ephemeral-containers/
- Dominant language
- Go
- Stars
- 228
- Forks
- 30
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 2
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from streamnative/function-mesh
-
streamnative/function-mesh#811 · 1 assignee ·
-
Difficulty 2/5 Half a day Newbie friendliness 45/100
streamnative/function-mesh#806 ·
-
streamnative/function-mesh#801 · 1 assignee ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
streamnative/function-mesh#796 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 25/100
streamnative/function-mesh#769 ·
All issues in streamnative/function-mesh
Similar issues
-
textual definition
Difficulty 1/5 Under an hour Newbie friendliness 90/100
geneontology/go-ontology#32653 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 75/100
-
needs design
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Priority/High ready-for-agent Severity/Major Type/Bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100