[siddontang]

We build our binary first with one image as the builder image, then use `copy` to copy the binary from the builder to the final executable image like alphine.

an example Dockerfile likes:

  FROM golang:1.18.1-alpine as builder
  # RUN apk add, wget, etc, and build the binary

  FROM alpine
  # or FROM scratch
  COPY --from=builder builder/binary /binary

  ENTRYPOINT ["/binary"]

[U1F984]

For Go you can use FROM scratch and save a couple more megabytes.

[lrvick]

This works on any language. I only use scratch in prod. Even for nodejs or python... compile a static interpreter binary and truck on.

Dev tools like bash, ls, grep, etc, have no place in production and only increase attack surface.

[nijave]

How do non running utilities increase attack surface? If you're able to execute inside the container couldn't you just write whatever utilities you want in?

[lrvick]

There are many exploits that may give one the ability to execute shell commands. If there is no shell or commands to even write a file in the first place, mobility becomes limited.

[CameronNemo]

Most container workloads I have use a read only root fs.

[8n4vidtmkvmk]

once in awhile i use 'kubectl exec ' to run some commands against my running prod containers to debug something or extract an environment variable. can i still do that without a shell or anything?

[dmart]

k8s has first-class support for ephemeral debug containers that share process namespaces for this purpose. Pretty cool feature imo.

https://kubernetes.io/docs/tasks/debug/debug-application/deb...

[cmckn]

You can’t, no. One approach is a “debug sidecar” container in the Pod that has your desired tools. Linkerd, for example, will add such a container if an annotation is present on the Pod: https://linkerd.io/2.11/tasks/using-the-debug-container/

I usually just include a shell, but to each their own.

[iruoy]

You'll need to make sure that the binary is statically linked though.

[fwip]

Out of curiosity, what does alpine provide for your container that you need? (I assume otherwise you'd be using `FROM scratch`.)

[maccard]

I use wget from it for health checks [0]

[0] https://stackoverflow.com/questions/47722898/how-to-do-a-doc...

[dlor]

A common gotcha is ca-certs and tzdata.

[siddontang]

yes, `FROM scratch` may be better most of the time. I just use `alphine` for many years, and have not tried `scratch` before.