Dockerizing with Distroless: A Guide to Secure and Optimized Containers
Dockerizing with Distroless images offers a highly effective way to reduce container size and improve security. By stripping down Docker images to just the application and its runtime dependencies—without the underlying operating system—Distroless containers provide significant benefits for both performance and security. This guide explores how you can use Distroless images to optimize Docker containers for popular languages like Node.js, Java, and Python.
What Are Dockerizing with Distroless Images?
Distroless Docker images are minimalist images that only include the application, runtime dependencies, and resources needed to run the app. Developed by Google, these images exclude unnecessary operating system components, which helps reduce both the attack surface and the container size. This approach is ideal for optimizing your Docker containers, as it minimizes vulnerabilities and leads to smaller, faster deployments.
Since Distroless images don’t contain a full operating system, you typically need to use a multi-stage Docker build. The first stage of the build handles tasks such as dependency installation, while the second stage copies only the necessary artifacts into the smaller, more secure Distroless image.
The Dockerization Process
Before jumping into Distroless, let’s first understand the basic process of Dockerizing an application. Dockerizing involves packaging your code, dependencies, and runtime environment into a container, making it portable and easy to deploy across various environments.
Here’s a simple example using Node.js to demonstrate the Dockerization process:
Example: Dockerizing with Distroless a Node.js Application
- Application Code (server.js)
This simple Express app runs on port 8080:const express = require('express'); const app = express(); app.get('/', (req, res) => { res.send('Hello There'); }); app.listen(8080, '0.0.0.0'); - Dependencies (package.json)
{ "name": "docker_web_app", "version": "1.0.0", "main": "server.js", "dependencies": { "express": "^4.16.1" } } - Dockerfile for Node.js
Use the official Node.js image, install dependencies, and expose the necessary port:FROM node:12 WORKDIR /usr/src/app COPY . . RUN npm ci --only=production EXPOSE 8080 CMD ["node", "server.js"] - Build and Run the Container After creating the Dockerfile, build and run the image:
docker build -t yourusername/repository-name . docker run -p 3000:8080 yourusername/repository-name
Transitioning to Distroless Images
Now, let’s explore how you can transition to Dockerizing with Distroless images. Distroless images help optimize security and performance by removing unnecessary system files. You’ll use a multi-stage build to first build the application in a regular Docker image, and then copy only the necessary files into a Distroless image.
Example 1: Dockerizing with Distroless a Node.js App
For a Node.js application, you can use a multi-stage Dockerfile to build your app in a standard Node.js image and then copy the files into a Distroless Node.js image:
# Use a Node.js image to build the app
FROM node:10.17.0 AS build-env
ADD . /app
WORKDIR /app
RUN npm ci --only=production
# Copy the app into a Distroless Node.js image
FROM gcr.io/distroless/nodejs
COPY --from=build-env /app /app
WORKDIR /app
CMD ["server.js"]
Example 2: Dockerizing with Distroless a Java App
For Java, use a multi-stage approach where you first compile the code and then copy the .jar file into the Distroless Java image:
# Use OpenJDK to build the app
FROM openjdk:11-jdk-slim AS build-env
ADD . /app/examples
WORKDIR /app
RUN javac examples/*.java
RUN jar cfe main.jar examples.HelloJava examples/*.class
# Copy the jar into a Distroless image
FROM gcr.io/distroless/java:11
COPY --from=build-env /app /app
WORKDIR /app
CMD ["main.jar"]
Example 3: Dockerizing with Distroless a Python App
For Python, you can use a similar process to install dependencies in a slim Python image and then transfer them to the Distroless Python image:
# Use a slim Python image to install dependencies
FROM python:3-slim AS build-env
COPY requirements.txt .
RUN pip install -r requirements.txt
# Use the Distroless Python image for production
FROM gcr.io/distroless/python3
WORKDIR /app
ENV VIRTUAL_ENV=/opt/venv
RUN python3 -m venv $VIRTUAL_ENV
ENV PATH="$VIRTUAL_ENV/bin:$PATH"
COPY --from=build-env /app /app
CMD ["hello.py", "/etc"]
Advanced Docker Optimization: Vendoring and Certificates
When working with complex applications, you may need to consider vendoring dependencies and managing certificates in your Docker images. Vendoring stores dependencies within the project, which is crucial in regulated environments or when working in networks with restricted internet access.
Certificates, often necessary for secure communications, can be added directly to the Distroless image, allowing the application to use them as needed.
Debugging Distroless Images
Debugging can be more challenging with Distroless images, as they lack shell access. However, there are debug versions of Distroless images available, which include a BusyBox shell. This allows you to troubleshoot issues within the container. Simply add the :debug tag to your Dockerfile to enable this functionality:
FROM gcr.io/distroless/python3:debug
Then, run the container with a shell entrypoint for debugging:
docker build -t my_fancy_image .
docker run --entrypoint=sh -ti my_fancy_image/app
Conclusion: Dockerizing with Distroless
Incorporating Dockerizing with Distroless images into your workflow can significantly improve the security, performance, and efficiency of your Docker containers. The reduction in size and the minimization of vulnerabilities make Distroless an excellent choice for production applications.
For even greater optimization and management of your containers, consider reaching out to ZippyOPS. We offer expert consulting, implementation, and managed services in areas like DevOps, DevSecOps, Cloud, Microservices, and Security. Our tailored solutions can help streamline your DevOps pipeline and optimize your infrastructure. Learn more about our services and products on our website, or contact us at sales@zippyops.com for a consultation.
