distroless VS podman

That's how we get distroless. Distroless base images follow the same pattern as alpine base docker images, as in, less functionality while still keeping enough functionality to be able to do the job and minimize the attack surface. Minimizing a base image like this means that the base images are very specialized so we have base images for golang, python, java and the like.

lots of questions here regarding what this product is. I guess i can provide some information for the context, from a perspective of an outside contributor.

Chainguard Images is a set of hardened container images.

They were built by the original team that brought you Google's Distroless (https://github.com/GoogleContainerTools/distroless)

However, there were few problems with Distroless:

1. distroless were based on Debian - which in turn, limited to Debian's release cadence for fixing CVE.

2. distroless is using bazelbuild, which is not exactly easy to contrib, customize, etc...

3. distroless images are hard to extend.

Chainguard built a new "undistro" OS for container workload, named Wolfi, using their OSS projects like melange (for packaging pkgs) and apko (for building images).

The idea is (from my understanding) is that

1. You don't have to rely on upstream to cut a release. Chainguard will be doing that, with lots of automation & guardrails in placed. This allow them to fix vulnerabilties extremely fast.

> If you have one image based on Ubuntu in your stack, you may as well base them all on Ubuntu, because you only need to download (and store!) the common base image once

This is only true if your infrastructure is static. If your infrastructure is highly elastic, image size has an impact on your time to scale up.

Of course, there are better choices than Alpine to optimize image size. Distroless (https://github.com/GoogleContainerTools/distroless) is a good example.

The same as our code dependencies, container updates can include security patches and bug fixes and improvements. However, they can also include breaking changes and it is crucial you test them thoroughly before putting them into production. Wherever possible, I recommend using the distroless base image which will drastically reduce both your image size, your risk vector, and therefore your maintenance version going forward.

# Use a large Node.js base image to build the application and name it "build" FROM node:18-alpine as build WORKDIR /app # Copy the package.json and package-lock.json files into the working directory before copying the rest of the files # This will cache the dependencies and speed up subsequent builds if the dependencies don't change COPY package*.json /app # You might want to use yarn or pnpm instead RUN npm install COPY . /app RUN npm run build # Instead of using a node:18-alpine image, we are using a distroless image. These are provided by google: https://github.com/GoogleContainerTools/distroless FROM gcr.io/distroless/nodejs:18 as prod WORKDIR /app # Copy the built application from the "build" image into the "prod" image COPY --from=build /app/.output /app/.output # Since this image only contains node.js, we do not need to specify the node command and simply pass the path to the index.mjs file! CMD ["/app/.output/server/index.mjs"]

Lots of examples without the entire OS as other comments mention, an example would be Googles distroless[0]

[0]: https://github.com/GoogleContainerTools/distroless

Docker doesn't do this all the time. Distroless Docker containers are relatively common. https://github.com/GoogleContainerTools/distroless

Docker is a company that maintains the Docker software and also offers a cloud service to run Docker containers in the cloud. They run DockerHub, which is a platform to store share and run Docker images. The actual standard for Docker containers is called OCI (Open Container Initiative). Because Docker is based on OCI there are many other tools that can interact with Docker containers, like Podman or Lima. If you want to go really deep, I really recommend reading the OCI specification! It's long but super interesting.

I install docker (this is quite a boring process, to make it sudoers and so I can run without sudo). On Mac instead I use podman.

Nowadays, we can’t talk about Docker without mentioning it’s alternative Podman.

I strongly recommend just switching the Dev environment over to Linux and taking advantage of tools like "distrobox" and "toolbx".

https://github.com/89luca89/distrobox

https://containertoolbx.org/

It is sorta like Vagrant, but instead of using virtualbox virtual machines you use podman containers. This way you get to use OCI images for your "dev environment" that integrates directly into your desktop.

https://podman.io/

There is some challenges related to usermode networking for non-root-managed controllers and desktop integration has some additional complications. But besides that it has almost no overhead and you can have unfettered access to things like GPUs.

Also it is usually pretty easy to convert your normal docker or kubernetes containers over to something you can run on your desktop.

Also it is possible to use things like Kubernetes pods definitions to deploy sets of containers with podman and manage it with systemd and such things. So you can have "clouds of containers" that your dev container needs access to locally.

If there is a corporate need for window-specific applications then running Windows VMs or doing remote applications over RDP is a possible work around.

If everything you are targeting as a deployment is going to be Linux anything then it doesn't make a lot of sense to jump through a bunch of hoops and cause a bunch of headaches just to avoid having it as workstation OS.

If you are using a modern Linux system like Fedora 40, you may want to configure systemd which manages services, and podman to run containers as an alternative to Docker. This setup makes it possible to run rootless containers as a normal user without worrying about giving the container global permissions.

I admit the title of this section sounds worse than it is, but the fact is that sometimes when you install Podman, you can also have an alias called "docker" pointing to "podman". That can make you believe that you are running Docker and come to the Docker forum asking about an issue which is actually not related to Docker. The alias exists because Podman tries to keep a similar command line interface to the interface of Docker, so when someone relies on an existing docker command, they don't have to rewrite their scripts if they are lucky.

3.Podman: As a daemonless container engine, Podman offers a command-line interface similar to Docker but does not require root privileges, providing an additional security buffer.

Both docker and podman support rootless containers. Podman is in no way "better" or "more modern" as you suggest, mostly everyone still uses docker.

https://docs.docker.com/engine/security/rootless/

https://github.com/containers/podman/blob/main/docs/tutorial...

This recipe allows you to deploy your app in a redistributable, virtualized, os agnostic, self-contained and self-configured software image and run it in virtualization engines such as Docker or Podman. It even includes things out of the box like the supervisor's tidy configuration for handling your queues, nice defaults for php, opcache and php-fpm, nginx, etc.

Thus motivated, install Podman Desktop, a Docker-compatible Linux containers tool with Podman. After Podman Desktop is installed and running, open a terminal and