Optimize Docker image #271
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dosubot
bot
added
size:M
marcofranssen
commented
Jan 28, 2025
| RUN make install | ||
| RUN --mount=type=cache,target=/go/pkg/mod \ | ||
| --mount=type=cache,target=/root/.cache/go-build \ | ||
| xx-go --wrap && \ |
There was a problem hiding this comment.
takes care of the plumbing like on line https://github.com/viaduct-ai/kustomize-sops/pull/271/files#diff-dd2c0eb6ea5cfc6c4bd4eac30934e2d5746747af48fef6da689e85b752f39557L21-L23
also has a verify command to virify the outcome of the binary.
|
Hey @marcofranssen awesome work. Are you able to show a before/after for image size? |
This change optimizes the layers, build speed, and foremost reduces vulnerabilities by switching to distroless/base image
marcofranssen
force-pushed
the
optimize-docker-image
branch
from
53717ac to
087356f
Compare
$ docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
ksops latest 83865ac306be About a minute ago 165MB
viaductoss/ksops latest fa92f7c8ba3f 4 hours ago 288MBFurthermore CVE in current image: $ trivy image viaductoss/ksops
………
viaductoss/ksops (debian 11.11)
Total: 156 (UNKNOWN: 0, LOW: 119, MEDIUM: 27, HIGH: 7, CRITICAL: 3)
………………
usr/local/bin/kustomize (gobinary)
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)
vs new image: $ trivy image ttl.sh/ksops-1234567890:1h
…………
ttl.sh/ksops-1234567890:1h (debian 12.9)
Total: 9 (UNKNOWN: 0, LOW: 7, MEDIUM: 2, HIGH: 0, CRITICAL: 0)
……………
…………
usr/local/bin/kustomize (gobinary)
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)So you can see it has massive lower dependencies and therefore also less vulnerabilities. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR optimizes the Docker image in following ways:
If necessary I can break up the PR in smaller chunks, but wanted to start with the full picture to show where I'm heading at.
Also seems like the Makefile and compiling can also be improved and much more efficient, would love to contribute that part as well in a follow-up PR.