Skip to content

Conversation

@ArchiFleKs
Copy link
Contributor

@ArchiFleKs ArchiFleKs commented Sep 10, 2024

Fixes #79

Signed-off-by: Kevin Lefevre [email protected]

@ArchiFleKs ArchiFleKs changed the title feat: optimize dockerfiles feat: optimize dockerfiles + best practices Sep 10, 2024
@mempirate
Copy link

mempirate commented Sep 11, 2024

Another suggestion here is to use one of the debian slim images as base, like debian:bookworm-slim. Should have a much smaller image size

@ArchiFleKs
Copy link
Contributor Author

@mempirate I'll test but can't we also use reqwest with native rust-tls and then use a scratch image with statically compiled binaries?

I haven't checked the whole codebase but something like this:

reqwest = { version = "0.12.5", default-features = false, features = [
  "rustls-tls",
  "json",
] }

Should work.

@mempirate
Copy link

I don't have a lot of experience with scratch images but that could be another option! There are other dependencies like libssl-dev and libssl3 (which include stuff like libcrypto etc) though.

@ArchiFleKs
Copy link
Contributor Author

I don't have a lot of experience with scratch images but that could be another option! There are other dependencies like libssl-dev and libssl3 (which include stuff like libcrypto etc) though.

Yes, I tried to statically compile with target musl and gnu and changing reqwest feature set to use rusttls-tls, it is almost impossible to get something coherent and it fails due to proc-macros (I somehow managed to build a statically compiled binary on archlinux which had both glibc and musl installed :P but I couldn't reproduced the behavior with docker images and cargo chef)

I think keeping the binary dynamically linked using debian is the easiest route for now

Signed-off-by: Kevin Lefevre <[email protected]>
@ArchiFleKs ArchiFleKs force-pushed the optmize-docker-images branch from 3dbf65c to b76884b Compare September 12, 2024 20:49
@ltitanb ltitanb merged commit 4753cae into Commit-Boost:main Sep 13, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Harden container security

3 participants