microcks / microcks/microcks-cli

Docker Hardened Images (dhi.io) as a new container image variant

Open
#298 0 comments 2 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
52
Forks
68
Avg merge
6h 54m
Merged PRs (30d)
10

Description

### Reason/Context

Like discussed with @lbroudoux and @yada, the Microcks project broadly could benefit from the free DHI images: https://www.docker.com/blog/docker-hardened-images-for-every-developer/.

This will allow to improve the security posture of Microcks CLI's end users, and will also minize the surface of maintenance for the Microcks's Maintainers (CVEs noise in the Scout dashboard, continuous patching of unnecessary packages, etc.).

### Description

The container image of the CLI could be optimized in terms of size, number of packages and number of CVEs. See my tests here: https://github.com/mathieu-benoit/microcks-cli/pull/1.

The goal is to provide a new `-distroless` variant, alongside the existing tags. The benefits of this new variant will allow to have the first tests with dhi.io for a Microcks project. It will allow to get an opt-in approach for the end users and not yet defaulting to it.

In the longer terms, if successful, we may want to reduce back the number of variant and defaulting the dhi.io image, but the proposition is to capture feedback and gain experience first.

### Implementation ideas

File to update: https://github.com/microcks/microcks-cli/blob/master/build/Dockerfile:
- `FROM golang` --> `FROM dhi.io/golang`
- `FROM registry.access.redhat.com/ubi9/ubi-minimal` --> `FROM dhi.io/static`

The actual implementation is already in my fork there: https://github.com/mathieu-benoit/microcks-cli/pull/1, see there for more details about the implementation and the actual outcomes/benefits.

If accepted, just let me know and I'll port this PR officially here if this is ok?

tl,dr - With DHI it's:
- 132 packages less
- 150MB on disk less
- 22 CVEs less
- `distroless` (no unnecessary package manager, `bash`, `curl`, etc.)

Contributor guide

Open the contributing guide

Research direction

Start with build/Dockerfile and compare it with the implementation in the linked fork pull request. Verify how the existing image tags are built, then confirm that an opt-in distroless variant is produced alongside them and provides the stated package, size, and CVE reductions.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, go
Domain
cli, devops
Issue type
Feature
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.