Distroless: Language focused docker images, minus the operating system

https://github.com/GoogleCloudPlatform/distroless

by jacobparker • 9 years ago

89 36 9 years ago

The images still have some "weird" stuff in them like man pages because they use deb packages from debian for common packages. That's not core to the idea, though (and note that apt is not included inside the container.)

nikolay2• 9 years ago

Being a distroless, it's still a larger base image than many distro-based ones.

mattomata6• 9 years ago

The video explains why. The goal isn't small, it's minimal.

By pursuing small at the expense of compatibility we got things like musl libc (which has tons of compat issues).

If all we wanted was small we could have started from musl libc and unpacked alpine packages the way we unpack debs.

nikolay2• 9 years ago

There are more minimalistic (and smaller!) and more compatible images out there though. So, we got the goal of distroless, but its good execution is yet to be seen!

catern3• 9 years ago

This project is still reliant on Debian to build all the packages. This project merely selects a set of packages that Debian has built.

yjftsjthsd-h• 9 years ago

I expect that makes it easier to maintain

jacobparker3• 9 years ago

They mention that in the video. It's an easy way currently to get built packages.

Bazel has plans on their roadmap (https://www.bazel.build/roadmap.html) to open-source rules for common packages ("Repository of BUILD files for third party OSS libraries open to the community") as a P2 for v1.0. This would presumably switch to using those when they're available.

Note that apt is not actually installed inside the container. Bazel just has a rule that knows how to unpack a deb.

catern3• 9 years ago

It's not just "an easy way to get built packages". It makes this project trivially easy. No need for Bazel, you can do what this project does with a small shell script.

I'm a bit disappointed to see Google releasing a project which ultimately is nothing more than a helpful API around Debian, and claiming it's some exciting new thing "minus the operating system". The README doesn't credit Debian at all.

macrael4• 9 years ago

Minimal docker images feel like the Right Choice for deployment artifacts. For a project I worked on recently that minimal image was a standalone go binary, nothing else in the image at all. But I was not sure how minimal was possible for a python project I was working on. Having standard base images for different languages will be great.

maslam• 9 years ago

Be oh so careful. We ran into issues with alpine node images that would only show up in minimal images like that. Switched to Debian and never looked back.

jacobparker3• 9 years ago

Was it because of musl libc? These images use glibc.

yokaze• 9 years ago

Funnily enough, I found it rather paradoxical (if you are developing in-house).

You choose a base, and that one is shared across your projects, so the size doesn't matter much within reason. Say, you go for Debian, then you count 50MB download and 100MB space over all your containers / apps, thanks to sharing. So, your stuff goes on top, potentially unshared (say multiple applications).

Which comes to the next contradiction: You then go then for a go-binary, which weighs in by itself easily over a 100MB of binary code. Unshared. Any advantage of self-containment of a go-binary (being statically linked) becomes more a liability, as it is the functionality you gain from docker-images (self-containment), without the sharing of the layers.

If you are focusing on delivering it to some random people, which would maybe care about having to install 100MB on top of whatever you are delivering, then I could see your point, but then you could just go for distributing the go-binaries themselves.

pebers• 9 years ago

Most Go binaries aren't over 100MB unless they have a bunch of data packed in them. 10-15MB seems more usual to me unless it's a particularly large project.

BraveNewCurency• 9 years ago

You then go then for a go-binary, which weighs in by itself easily over a 100MB of binary code.

Hah, I'd love something that small. Right now, we have dozens of Node.JS apps, each one needing over 500MBs of NPM libraries..

mattomata6• 9 years ago

Right, "nothing else" = "FROM scratch".

In the talk, I call this "FROM scratch -- for the rest of us."

That a half-truth because this also tries to set up a minimal compatible environment for common cases, e.g. it sets up ca-certs, a /tmp directory, and an /etc/passwd file.

macrael4• 9 years ago

That makes a lot of sense. How did you decide where to draw the line on what to include and what to leave out?

marmaduke• 9 years ago

How is a single go bin in an image better than that bin by itself?

macrael4• 9 years ago

Fundamentally it's not, but because Docker is a standard, you can throw that anywhere docker images can be consumed and run it. So, for instance, I was deploying to GKE which was easy to do. My docker deployment image was tiny (just the size of the binary) and I could run it anywhere.

alexnewman2• 9 years ago

Bazel is the worst part of google. It ruined tensorflow as well

CHANCECHANEL• 9 years ago

Could not agree more. Let's install Java to build something that does not needs Java at all. They could have used Go, Python, hell even something like CMake.

jitl• 9 years ago

This seems like a packaging problem. In Java 9, it's possible to produce a single binary containing the JRE and application code; same way as go producing a single binary containing the Go runtime and application code.

Python

Then you have to install the right version of python, and you get even more of a nightmare than a Java install. At least the Java ecosystem doesn't suggest a separate tool (eg, virtualenv or similar) to support things like JAVA_HOME.

This applies equally to any non-statically-compiled application distribution; I don't see CMake files + some specially blessed CMake version that you also have to install as coming close to that.

skybrian2• 9 years ago

It's not immediately useful, but you might find this interesting:

https://github.com/google/skylark

steren• 9 years ago

Are you on Windows? If so, Bazel now bundles the JDK so you should not have to worry about Java.

macrael4• 9 years ago

How did it ruin Tensorflow? My interaction with it has been largely that it is a good idea but too new to be relied upon.

earlybike3• 9 years ago

Docker already recommends the tiny 5MB Alpine distro as the default for all containers, they hired Alpine's creator Natanael Copa[2]. Alpine is minimal but still has an awesome package manager[1], is maintained/proven/solid and provides a great UX as a container OS.

So what is my advantage of distroless vs Alpine besides the 5MB? Feels a bit like reinventing the wheel or I missed something.

[1] https://pkgs.alpinelinux.org/packages

[2] https://www.brianchristner.io/docker-is-moving-to-alpine-lin...

mattomata6• 9 years ago

Alpine is built around musl libc, which has numerous compatibility differences from a traditional glibc: http://wiki.musl-libc.org/wiki/Functional_differences_from_g...

Some folks solve this by adding glibc to Alpine (IIUC this is what Envoy is building upon).

It has a package manager, but it is far from as comprehensive. The security database is still essentially an experiment with much less richness than Ubuntu, Debian, Redhat, ...

If what you want is a package manager, you probably want minideb from the Bitnami folks.

earlybike3• 9 years ago

numerous compatibility differences

I did never experienced any.

It has a package, but it is far from comprehensive

Still better than the missing package manager of a distroless container (this was the comparison). However, I think it‘s quite good.

The security database is still essentially an experiment with much less richness than Ubuntu, Debian, Redhat, ...

Do you have some sources proving it‘s an experiment?

Distroless: Language focused docker images, minus the operating system

Related Stories