Skip to content

Conversation

@vmercierfr
Copy link
Collaborator

@vmercierfr vmercierfr commented May 5, 2025

Objective

Reduce attack surface

Why

Prometheus RDS exporter is deployed using alpine container base image. Although this image is minimalist, it contains around 200 binaries that are not required to run the application and increase its attack surface.

Kubernetes project adopted distroless few years ago to limit container image content to application and its runtime.

In addition to safety benefits, the container image is reduced by 9% (53MB to 48MB).

dive
Before before
After after

How

Release

  • Merge this PR

@vmercierfr vmercierfr force-pushed the adopt-distroless branch 2 times, most recently from ca922b6 to 4d8f8e8 Compare May 5, 2025 21:07
vmercierfr added 5 commits May 5, 2025 23:19
Signed-off-by: Vincent Mercier <vmercier@gmail.com>
Signed-off-by: Vincent Mercier <vmercier@gmail.com>
Signed-off-by: Vincent Mercier <vmercier@gmail.com>
Signed-off-by: Vincent Mercier <vmercier@gmail.com>
Signed-off-by: Vincent Mercier <vmercier@gmail.com>
@vmercierfr
Copy link
Collaborator Author

This will conflicts with #249. But sounds HEALTHCHECK is only supported by Docker (desktop?) engine and probably not relevant for production deployment these days.

So I will recommend to just remove HEALTHCHECK instruction in favor of attack surface reduction.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants