Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use busybox from alpine #51

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Use busybox from alpine #51

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
67a9d1a
Use busybox from alpine
liam-verta Oct 19, 2022
7db9a8c
Use static linked busybox
liam-verta Nov 17, 2022
9b33bd6
Add alpine-glibc
liam-verta Nov 18, 2022
dc1e8c1
Build from scratch
liam-verta Dec 15, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,13 @@ The following files are added (taken from Debian) to fix some common issues:
- `/etc/services` : for named ports resolution
- `/lib/x86_64-linux-gnu/libpthread.so.0` : common required lib for project binaries that cannot be statically built.

### prom/busybox:alpine : musl-libc

Based on the official `alpine:latest` base image.

The `busybox` executable is replaced by the [statically linked busybox](https://pkgs.alpinelinux.org/package/v3.16/main/x86_64/busybox-static) from `alpine:latest`.
The Alpine project provides far more timely security patches to `busybox` that the official `busybox` release.

## Build Docker images locally

```
Expand Down
27 changes: 27 additions & 0 deletions alpine/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
ARG ARCH=""
FROM ${ARCH}alpine:latest as alpine

RUN apk upgrade -U && \
apk add tzdata ca-certificates

# Use the busybox.static to avoid dynamic library dependencies.
RUN apk add busybox-static && \
mv /bin/busybox.static /bin/busybox && \
/bin/busybox --install -s /bin

Comment on lines +7 to +11
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Previous iterations were trying to not include musl-libc . In this iteration, I haven't remove it. If that is okay, then we can leave the default dynamic linked busybox.

Suggested change
# Use the busybox.static to avoid dynamic library dependencies.
RUN apk add busybox-static && \
mv /bin/busybox.static /bin/busybox && \
/bin/busybox --install -s /bin

# remove extra package
RUN apk del libc-utils

# remove apk files and directories
RUN apk del apk-tools && \
find / -name apk -prune -exec rm -rf {} ";"
Comment on lines +13 to +17
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Combine these steps to reduce layers.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't need to worry about these layers because the COPY on line 26 flattens all the build layers to a single layer in the final image.



# remove extraneous folders
RUN rm -rf media mnt opt run srv

FROM scratch
MAINTAINER The Prometheus Authors <[email protected]>

COPY --from=alpine / /
Comment on lines +23 to +26
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is copying everything, so, doing FROM scratch seems unnecessary. Our other images only copy over specific configuration files in order to make sure busybox is the only binary in the final image.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure what you're asking for here.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think what @SuperQ is suggesting is instead of removing the unneeded things in the base image and then copying everything here, we should use explicitly only COPY here what we need.
Can you only copy busybox here and then run /bin/busybox --install -s /bin in the final image?