microcks / microcks/microcks-cli
Docker Hardened Images (dhi.io) as a new container image variant
- Dominant language
- Go
- Stars
- 52
- Forks
- 68
- Avg merge
- 6h 54m
- Merged PRs (30d)
- 10
Description
### Reason/Context
Like discussed with @lbroudoux and @yada, the Microcks project broadly could benefit from the free DHI images: https://www.docker.com/blog/docker-hardened-images-for-every-developer/.
This will allow to improve the security posture of Microcks CLI's end users, and will also minize the surface of maintenance for the Microcks's Maintainers (CVEs noise in the Scout dashboard, continuous patching of unnecessary packages, etc.).
### Description
The container image of the CLI could be optimized in terms of size, number of packages and number of CVEs. See my tests here: https://github.com/mathieu-benoit/microcks-cli/pull/1.
The goal is to provide a new `-distroless` variant, alongside the existing tags. The benefits of this new variant will allow to have the first tests with dhi.io for a Microcks project. It will allow to get an opt-in approach for the end users and not yet defaulting to it.
In the longer terms, if successful, we may want to reduce back the number of variant and defaulting the dhi.io image, but the proposition is to capture feedback and gain experience first.
### Implementation ideas
File to update: https://github.com/microcks/microcks-cli/blob/master/build/Dockerfile:
- `FROM golang` --> `FROM dhi.io/golang`
- `FROM registry.access.redhat.com/ubi9/ubi-minimal` --> `FROM dhi.io/static`
The actual implementation is already in my fork there: https://github.com/mathieu-benoit/microcks-cli/pull/1, see there for more details about the implementation and the actual outcomes/benefits.
If accepted, just let me know and I'll port this PR officially here if this is ok?
tl,dr - With DHI it's:
- 132 packages less
- 150MB on disk less
- 22 CVEs less
- `distroless` (no unnecessary package manager, `bash`, `curl`, etc.)
Contributor guide
Research direction
Start with build/Dockerfile and compare it with the implementation in the linked fork pull request. Verify how the existing image tags are built, then confirm that an opt-in distroless variant is produced alongside them and provides the stated package, size, and CVE reductions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, go
- Domain
- cli, devops
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100