stackabletech / stackabletech/docker-images
Slim down product images
Nobody has claimed this yet.
- Dominant language
- Dockerfile
- Stars
- 22
- Forks
- 6
- Avg merge
- 16h 59m
- Merged PRs (30d)
- 30
Description
We might have some potential to slim down product images. This can reduce build time, image size and attack surface. For example, the Hive Dockerfile has a comment about Hadoop: https://github.com/stackabletech/docker-images/blob/1965d50dc436552d4c7e06363f4b1ed46deac29c/hive/Dockerfile#L102
Now that we build from source, it might be worth digging into the build processes to:
a) Limit which components we build. It doesn't make sense to build stuff that's never copied to the final image.
b) Revalidate if all the components that are copied into the final image are really needed in production. With Hive, for example, we switched the build to only build the metastore, which significantly reduced the attack surface. Some products consist of multiple components and plugins, which might not all be needed to run the platform.
c) While we're at it, try to generate an SBOM for each component that is copied into the final image (next to the component itself). For most components that should already be the case, see https://github.com/stackabletech/docker-images/pull/814
We want to focus on products that are mostly affected by vulnerabilities right now:
- Trino
- Hive
- HBase
Acceptance criteria:
- Document what could be removed and the impacts of the removal
- Document what can't be removed and why it can't be removed
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the Hive Dockerfile comment and the build processes for Trino, Hive, and HBase, then compare the components copied into their final images. Use pull request 814 as the reference for component SBOMs. Done means documenting removable components and their impacts, plus documenting components that cannot be removed and why.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, dockerfile
- Domain
- build-system, devops, security
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100