conductor-oss / conductor-oss/conductor
Produce slim distributions with reduced out-of-the-box backend compatibility
- Dominant language
- Java
- Stars
- 32.2k
- Forks
- 1k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 41
Description
### The feature, motivation and pitch
As of right now, conductor ships with out of the box support for an abundance of backends. While highly convenient, this bloats the transitive dependency set, and many unused packages in a given deployment can flag known CVEs. As an example, a postgres/redis deployment will get nearly a dozen CVEs flagged today from elasticsearch JARs shaded within conductor-server, with no ability for downstream developers to remove those jars without forking and rebuilding their own slimmed-down conductor image.
A much better approach would be to provide a 'slim' distribution alternative where only those dependencies that are needed can be re-added. I'll be honest, I'm not a Spring expert, but I'm inclined to assume that some things can be loaded from a dynamic classpath.
### Alternatives
_No response_
### Additional context
_No response_
Contributor guide
Research direction
Start by examining the conductor-server dependency set and how Spring loads backend integrations. Define what a slim distribution must exclude and how required backends can be added, then verify that a postgres/redis deployment no longer includes unrelated Elasticsearch JARs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring-boot
- Domain
- backend, distributed-systems
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100