On Wed, Aug 7, 2019, at 11:25 AM, Colin Walters wrote:
On Tue, Jul 30, 2019, at 3:52 PM, Daniel Walsh wrote:
> If you want small images, just use buildah.
Dockerfile-based multi-stage builds are significantly more popular than
this and should really be mentioned first.
I'm not saying `buildah` is bad, but...what you're talking about here
also encourages using the host as a build root which has various
negatives.
And I think the main conversation to have is whether we should
introduce something more like
https://github.com/GoogleContainerTools/distroless
that basically just has:
- glibc
- ca-certificates
And an interesting discussion here is whether to include e.g. openssl.
golang by default uses custom (statically linked) crypto but it can be configured to use
openssl.
Rust doesn't have a default but...openssl is at least a common option.