Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: optimize dockerfiles + best practices #112

Merged
merged 1 commit into from
Sep 13, 2024

Conversation

ArchiFleKs
Copy link
Contributor

@ArchiFleKs ArchiFleKs commented Sep 10, 2024

Fixes #79

Signed-off-by: Kevin Lefevre archi@kiln.fi

@ArchiFleKs ArchiFleKs changed the title feat: optimize dockerfiles feat: optimize dockerfiles + best practices Sep 10, 2024
@mempirate
Copy link

mempirate commented Sep 11, 2024

Another suggestion here is to use one of the debian slim images as base, like debian:bookworm-slim. Should have a much smaller image size

@ArchiFleKs
Copy link
Contributor Author

@mempirate I'll test but can't we also use reqwest with native rust-tls and then use a scratch image with statically compiled binaries?

I haven't checked the whole codebase but something like this:

reqwest = { version = "0.12.5", default-features = false, features = [
  "rustls-tls",
  "json",
] }

Should work.

@mempirate
Copy link

I don't have a lot of experience with scratch images but that could be another option! There are other dependencies like libssl-dev and libssl3 (which include stuff like libcrypto etc) though.

@ArchiFleKs
Copy link
Contributor Author

I don't have a lot of experience with scratch images but that could be another option! There are other dependencies like libssl-dev and libssl3 (which include stuff like libcrypto etc) though.

Yes, I tried to statically compile with target musl and gnu and changing reqwest feature set to use rusttls-tls, it is almost impossible to get something coherent and it fails due to proc-macros (I somehow managed to build a statically compiled binary on archlinux which had both glibc and musl installed :P but I couldn't reproduced the behavior with docker images and cargo chef)

I think keeping the binary dynamically linked using debian is the easiest route for now

Signed-off-by: Kevin Lefevre <archi@kiln.fi>
@ArchiFleKs ArchiFleKs force-pushed the optmize-docker-images branch from 3dbf65c to b76884b Compare September 12, 2024 20:49
@ltitanb ltitanb merged commit 4753cae into Commit-Boost:main Sep 13, 2024
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Harden container security
3 participants