15
Small and secure Docker images for Rust: Alpine vs Debian vs Scratch (kerkour.com)
submitted 1 month ago by to c/rust@programming.dev
comment fedilink hide all child comments
 

Was recently somewhat surprised that you can't just copy a Rust executable into a ´scratch´ container and have it work, so this is a cool blog post to find in my RSS feed.

I'm guessing, if you're doing something less complex, then you just need the ´musl´ target and the allocator...

no comments (yet)

sorted by: hot top controversial new old
there doesn't seem to be anything here
11 comments in c/rust@lemmy.ml view that post
[–] 3 points 1 month ago (2 children)

Personally, I settled on wolfi-base, which feels a lot like Alpine, but is based on glibc, so there's fewer compatibility issues. I also considered debian-slim, but there's just too many CVEs in Debian, and I was fed up with it being so outdated all the time. What I really wanted was something like wolfi, but more open, i.e., not associated with paid images. We need a glibc-based Alpine!

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] 3 points 1 month ago* (last edited 1 month ago) (1 child)

    Thanks, I hadn't heard of Wolfi, nor of Chainguard. They are by a for-profit company, which isn’t an automatic deal-breaker by any means—it could even be a positive—but I do have some more homework to do before jumping onboard.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 3 points 1 month ago

    Because most images from Chainguard are paid, apart from the base image, the way I use it is through multi-stage builds, where I simply copy what I need from other images into the wolfi base, unless of course it's just easier to install what I want using apk. If I could do that with plain Alpine, I would, but most stuff is compiled for glibc, so it's a no-go.

    If security is the main factor for your, I'd recommend you scan the image with grype, so you can get a grasp of how many CVEs you're working with.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 3 points 1 month ago (6 children)

    Why would you build docker images for Rust? I mean if you’re renting containers from data centers or just want to run in a sandbox - sure… but rust binaries are statically linked which negates almost all other benefits of containers.

  • permalink
  • fedilink
  • source
  • hideshow 6 child comments
    •
  • [–] 2 points 1 month ago (5 children)

    Easier to deploy and manage for server use?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 1 point 1 month ago (4 children)

    That’s what I’m saying though - with statically linked binaries it’s just as easy to deploy the binary as it is the docker image.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] [S] 5 points 1 month ago (1 child)

    You're looking at it from the perspective of having coded a single application and wanting to deploy it. Try to think more like a sysadmin:

    • You've got a whole bunch of applications to deploy. Some of them may use dynamic linking, too.
    • You don't know any of them too intimately, so want to just prevent them from interfering with each other, unless you allow it.
    • You want a uniform tool to manage all these different applications, and especially also when they're allowed to interact.

    The result is deployment orchestration tools like Kubernetes, Docker Compose, Podman Compose etc.. And as a dev, you have to provide a container image, if you want to play along in those.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
    • [–] 2 points 1 month ago

    What about nix2container?

  • permalink
  • fedilink
  • source
    •