apache / apache/beam

[Distroless]: Support distroless container images

Open
#32,815 2 comments 0 reactions 0 assignees View on GitHub
docker infra new feature P2 pinned
Dominant language
Java
Stars
8.7k
Forks
4.7k
Avg merge
1d 20h
Merged PRs (30d)
196

Description

# Summary

This issue tracks the feature to add [distroless](https://github.com/GoogleContainerTools/distroless) support to new and variants of existing Beam container images.

# What problem does this solve

Portable runner execution relies on containerization of Beam’s dependencies. These container images harbor several security vulnerabilities. One vector of these vulnerabilities stem from the use of container image bases that provide access to the operating system, which may unnecessarily expose the development environment. For an informative and entertaining discussion on this, see [Containers Are Not VMs! Which Base Container (Docker) Images Should We Use?](https://www.youtube.com/watch?v=82ZCJw9poxM).

# Goals

- [x] #32816
- [x] #32817
- [ ] #32818
- [x] #32822

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.