conductor-oss / conductor-oss/conductor

Produce slim distributions with reduced out-of-the-box backend compatibility

Open
#1,265 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
32.2k
Forks
1k
Avg merge
2d 5h
Merged PRs (30d)
41

Description

### The feature, motivation and pitch

As of right now, conductor ships with out of the box support for an abundance of backends. While highly convenient, this bloats the transitive dependency set, and many unused packages in a given deployment can flag known CVEs. As an example, a postgres/redis deployment will get nearly a dozen CVEs flagged today from elasticsearch JARs shaded within conductor-server, with no ability for downstream developers to remove those jars without forking and rebuilding their own slimmed-down conductor image.

A much better approach would be to provide a 'slim' distribution alternative where only those dependencies that are needed can be re-added. I'll be honest, I'm not a Spring expert, but I'm inclined to assume that some things can be loaded from a dynamic classpath.

### Alternatives

_No response_

### Additional context

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by examining the conductor-server dependency set and how Spring loads backend integrations. Define what a slim distribution must exclude and how required backends can be added, then verify that a postgres/redis deployment no longer includes unrelated Elasticsearch JARs.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring-boot
Domain
backend, distributed-systems
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.