See all results

What is image distillation?

2 min read

There are at least four ways to go about building container images:

  • Small distributions, like Alpine
  • Cut-down server versions (e.g., debian-slim)
  • Whatever tf Ubuntu Chiseled is
  • Distroless

I use a fifth one.

Pain

In my experience, no one really likes building Alpine images, but because they're so lean, people feel forced to. MUSL, busybox, ash, python issues, package names often differ, command flags vary slightly, and so on.

I've used Ubuntu/Debian as an image base since 2018 because my developers were Debian-oriented and felt much more confident whenever they had to operate inside containers to debug.

In production, though, Debian-based images are far from perfect. Debian has long confused 'paleolithic' with 'stability.' Meanwhile, Canonical adds useless thingamajigs like Pebble—complete with a bunch of Go stdlib vulnerabilities—or ruins RISC-V compatibility with an unnecessary move to vector extensions.

Distroless images are pure and perfect — and also feel like a war crime when you're actually building them. Every single dependency has to be hand-crafted, and you constantly feel phantom pain from missing basic shell tools.

Don't get me wrong: I love it, but it's a kink.

Distillation

To keep a cozy environment while working on a project, while simultaneously stripping down the attack surface of the production image, I use a technique I call image distillation.

It's fairly obvious (I'm pretty sure many people do this, I didn't invent anything), but I haven't found an established term for it yet (I'd be glad to be proven wrong if you know one).

  1. Build in whatever base image you like: Alpine, Ubuntu, or whatever Red Hat is calling their server distro this week.
  2. At the end of that build stage, COPY everything you actually need (binary + libraries + runtime data) into a single folder (mine is usually called /export).
  3. Add a final stage with FROM scratch or FROM distroless, with a single COPY --from=builder /export /.

You get the fat-free security of distroless in production with the developer pleasantries of a full OS during build time.

You won't get any progress in understanding the meaning of life or finding true love, though.

It's just a slim container image, what did you expect?

Related