Docker container and build flags

[mszmidt]

Hi, what do you think about such workflow:

I build custom alpine container and its size is ~5x smaller in the end, if I additionally strip unnecessary debug information using go build with -ldflags="-s -w"
What is more, one could also want to have more secure container, so that inside there is another dedicated user (for instance named feedpushr).

REPOSITORY          TAG             IMAGE ID      CREATED        SIZE
patched-feedpushr   3.4.0-rootless  xxxxxxxxxxxx  4 days ago     42.2 MB
ncarlier/feedpushr  3.4.0           26dd59e5bc42  16 months ago  213 MB

How about tags x.x.x-alpine x.x.x-alpine-rootless?

#########################################
# Build stage
#########################################
FROM golang:1.23-alpine AS builder

# Repository location
ARG REPOSITORY=github.com/ncarlier

# Artifact name
ARG ARTIFACT=feedpushr

# Copy sources into the container
ADD . /go/src/$REPOSITORY/$ARTIFACT

# Set working directory
WORKDIR /go/src/$REPOSITORY/$ARTIFACT

# Build the binary
RUN make build plugins

AND now 2 flavors:

• root
• rootless

#########################################
# Distribution root
#########################################
FROM alpine:latest

# Repository location
ARG REPOSITORY=github.com/ncarlier

# Artifact name
ARG ARTIFACT=feedpushr

# Install project files
COPY --from=builder /go/src/$REPOSITORY/$ARTIFACT/release/ /usr/local/share/$ARTIFACT/

# Install binary
COPY --from=builder /go/src/$REPOSITORY/$ARTIFACT/release/$ARTIFACT /usr/local/bin/$ARTIFACT

# Define working directory
WORKDIR /usr/local/share/$ARTIFACT

# Define entrypoint
ENTRYPOINT [ "feedpushr" ]

#########################################
# Distribution rootless
#########################################
FROM alpine:latest

# Repository location
ARG REPOSITORY=github.com/ncarlier

# Artifact name
ARG ARTIFACT=feedpushr

# Install project files
COPY --from=builder /go/src/$REPOSITORY/$ARTIFACT/release/ /usr/local/share/$ARTIFACT/

# Install binary
COPY --from=builder /go/src/$REPOSITORY/$ARTIFACT/release/$ARTIFACT /usr/local/bin/$ARTIFACT

RUN addgroup -g 1000 feedpushr &&\
    adduser -D -H -u 1000 -G feedpushr feedpushr &&\
    chown -R feedpushr:feedpushr /usr/local/share/$ARTIFACT

# Switch user to rootless
USER 1000

# Define working directory
WORKDIR /usr/local/share/$ARTIFACT

# Define entrypoint
ENTRYPOINT [ "feedpushr" ]

[ncarlier]

Hi,

thank you for this proposal.

I'm not quite sure of the real savings: The base image is using Distroless that is smaller than Alpine (2MB vs 5Mb). Furthermore Distroless should be more secure because you don't have any shell. However, maybe we should use nonroot tag in order to have a rootless image (in the event of compromise of the Feedpushr binary).

Given the size of your image (42.2 MB), I wonder if you have a plugin? Each plugin is a shared library (.so file). And because of Go the payload is quite big (~15Mo per plugin).

Using the -s -w LDFLAGS should save 10Mb but I have to test plugins compatibility with static binary.

[Wobak]

If I may add something to consider, it would be interesting to put a wrapper in the entrypoint script to change the UID / GID of the nonroot user to allow customization.