stackabletech / stackabletech/docker-images

Slim down product images

Open
#816 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Dockerfile
Stars
22
Forks
6
Avg merge
16h 59m
Merged PRs (30d)
30

Description

We might have some potential to slim down product images. This can reduce build time, image size and attack surface. For example, the Hive Dockerfile has a comment about Hadoop: https://github.com/stackabletech/docker-images/blob/1965d50dc436552d4c7e06363f4b1ed46deac29c/hive/Dockerfile#L102

Now that we build from source, it might be worth digging into the build processes to:
a) Limit which components we build. It doesn't make sense to build stuff that's never copied to the final image.
b) Revalidate if all the components that are copied into the final image are really needed in production. With Hive, for example, we switched the build to only build the metastore, which significantly reduced the attack surface. Some products consist of multiple components and plugins, which might not all be needed to run the platform.
c) While we're at it, try to generate an SBOM for each component that is copied into the final image (next to the component itself). For most components that should already be the case, see https://github.com/stackabletech/docker-images/pull/814

We want to focus on products that are mostly affected by vulnerabilities right now:

  • Trino
  • Hive
  • HBase

Acceptance criteria:

  • Document what could be removed and the impacts of the removal
  • Document what can't be removed and why it can't be removed

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the Hive Dockerfile comment and the build processes for Trino, Hive, and HBase, then compare the components copied into their final images. Use pull request 814 as the reference for component SBOMs. Done means documenting removable components and their impacts, plus documenting components that cannot be removed and why.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, dockerfile
Domain
build-system, devops, security
Issue type
Refactor
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.