feat: Add Dockerfile with wolfi-base as production image #9029 #16481
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Draft PR with wolfi based Dockerfile following on from #9029 and #12708.
This is not a distroless Dockerfile. The final image includes a package manager and a shell. If a truly distroless image is wanted, I think @tuananh's proposal is the best solution: https://github.com/tuananh/distroless-argocd. That proposal was rejected (understandably) as it makes large changes to both the build system and base images.
This proposal is something of a half-way house. The production image is moved to wolfi-base, which includes a shell and package manager which allows simple installation of the multiple dependencies required by argocd. The final image is 275MB, which is considerably smaller than the current 417MB image (as reported by
docker images
).I have not fully tested this image. It builds, but I wanted to get some feedback before going further. Please let me know what you think and if I should continue down this path.
BTW was there ever an attempt to use alpine? I'm assuming there was an issue there to do with musl vs gllibc?
Closes [ISSUE 9029] (actually I'm not sure it does, but it's related).
Checklist:
Not yet, this needs to be done but wanted to discuss first.