fedora-distroless

Base container based on fedora RPM packages which only contains minimal requirements for running golang applications.

Right now it includes:

• glibc
• ca-certificates
• Root user entry
• Basic nsswitch configuration
• An empty tmp folder

Why

This is inspired by distroless.

Using small containers but still using RPMs gives some key advantages for CI/CD:

• Smaller size means faster recovery while only using minimal network and storage resources. This is exactly what is needed in the case that clusters are already in trouble anyway.
• Small size means that pre-distributing the small images is fast and does not need much disk space.
• Exclusively adding used runtime dependencies to the image reduces the attack surface.
• Exclusively adding used runtime dependencies to the image reduces the need to rebuild because of CVEs while at the same time allows faster and more painless role-out of new versions, because of the small image size.
• Using maintained RPMs as source still makes updating easily in case of CVEs which affect the runtime dependencies of the container.
• Easier to create reproducible builds, since updating to newer base images of a whole OS typically adds and removes a lot of things in an intransparent way.

There is only one disadvantage:

• Debugging is harder, since docker exec or kubectl exec will typically not work. However it is possible to copy a statically compiled shell into running containers.

How to use it

Reference the build in your WORKSPACE file:

container_pull(
  name = "golang_base",
  registry = "docker.io",
  repository = "rmohr/fedora-distroless",
  digest = "sha256:ef94c65fcb3c9d328439aef271ba3dd20a3091fee241ada8818ecdcc2478e3c1",
)

Then use it as base for your golang binaries in your BUILD files:

go_image(
    name = "go_image",
    srcs = ["main.go"],
    importpath = "github.com/your/path/here",
    goarch = "amd64",
    goos = "linux",
    pure = "on",
    base = "@golang_base//image",
)