gRPC VS distroless

That's not true at all. Case in point In general, this is not a problem that AGC can solve. The language can help (something Java is admittedly particularly bad at) but even so, there'll always be avenues for leaks. That's just the nature of shared things. Interestingly, in the linked grpc case, the leaked memory is only half the problem -- AGC doesn't help at all with the leaked HTTP2 connection.

I've trialled my new image with an existing project via JLink that's heavy on Netty and gRPC the image works great (with a small tweak to exclude grpc-netty-shaded due to grpc-java#9083).

When developing an application, the vast majority of code is written by other people. We import that code and make use of it to get whatever we need done. In this case, the developer of an various android applications are using grpc-java.

`proto_library` for building the `.bin` file from protos works great. Generating stubs/messages for "all" languages does not. Each language does not want to implement gRPC rules, the gRPC team does not want to implement rules for each language. Sort of a deadlock situation. For example:

- C++: https://github.com/grpc/grpc/blob/master/bazel/cc_grpc_libra...

- Python: https://github.com/grpc/grpc/blob/master/bazel/python_rules....

- ObjC: https://github.com/grpc/grpc/blob/master/bazel/objc_grpc_lib...

- Java: https://github.com/grpc/grpc-java/blob/master/java_grpc_libr...

- Go (different semantics than all of the other): https://github.com/bazelbuild/rules_go/blob/master/proto/def...

But there's also no real cohesion within the community. The biggest effort to date has been in https://github.com/stackb/rules_proto which integrates with gazelle.

tl;dr: Low alignment results in diverging implementations that are complicated to understand for newcomers. Buff's approach is much more appealing as it's a "this is the one way to do the right thing" and having it just work by detecting `proto_library` and doing all of the linting/registry stuff automagically in CI would be fantastic.

Small clarification (to my understanding, I'm not a Java Guru) on why Java got on top - those Java implementations use something called Direct Executor. It's super performant when there's no chance of a blocking operation. But if you are to do anything more than echo service, you might be in trouble. Other implementations probably don't suffer from the same constraint. The related discussion can be found in this PR.

clone https://github.com/grpc/grpc-java

If you do streaming then the best option would be to use a so called manual flow control. You can find an example here.

Another interesting link is their official grpc-java benchmarks project, which is also used in the benchmark I've posted you.

Both JLink (gRPC#3522) and Graal have some issues; I'm especially concerned about the Serial GC in Graal so will be putting that under some stress soon to see if that confirms my suspicions. I'll also be good when some Java 16 JRE Alpine images appear as the JDK is too bloaty.

lots of questions here regarding what this product is. I guess i can provide some information for the context, from a perspective of an outside contributor.

Chainguard Images is a set of hardened container images.

They were built by the original team that brought you Google's Distroless (https://github.com/GoogleContainerTools/distroless)

However, there were few problems with Distroless:

1. distroless were based on Debian - which in turn, limited to Debian's release cadence for fixing CVE.

2. distroless is using bazelbuild, which is not exactly easy to contrib, customize, etc...

3. distroless images are hard to extend.

Chainguard built a new "undistro" OS for container workload, named Wolfi, using their OSS projects like melange (for packaging pkgs) and apko (for building images).

The idea is (from my understanding) is that

1. You don't have to rely on upstream to cut a release. Chainguard will be doing that, with lots of automation & guardrails in placed. This allow them to fix vulnerabilties extremely fast.

> If you have one image based on Ubuntu in your stack, you may as well base them all on Ubuntu, because you only need to download (and store!) the common base image once

This is only true if your infrastructure is static. If your infrastructure is highly elastic, image size has an impact on your time to scale up.

Of course, there are better choices than Alpine to optimize image size. Distroless (https://github.com/GoogleContainerTools/distroless) is a good example.

The same as our code dependencies, container updates can include security patches and bug fixes and improvements. However, they can also include breaking changes and it is crucial you test them thoroughly before putting them into production. Wherever possible, I recommend using the distroless base image which will drastically reduce both your image size, your risk vector, and therefore your maintenance version going forward.

# Use a large Node.js base image to build the application and name it "build" FROM node:18-alpine as build WORKDIR /app # Copy the package.json and package-lock.json files into the working directory before copying the rest of the files # This will cache the dependencies and speed up subsequent builds if the dependencies don't change COPY package*.json /app # You might want to use yarn or pnpm instead RUN npm install COPY . /app RUN npm run build # Instead of using a node:18-alpine image, we are using a distroless image. These are provided by google: https://github.com/GoogleContainerTools/distroless FROM gcr.io/distroless/nodejs:18 as prod WORKDIR /app # Copy the built application from the "build" image into the "prod" image COPY --from=build /app/.output /app/.output # Since this image only contains node.js, we do not need to specify the node command and simply pass the path to the index.mjs file! CMD ["/app/.output/server/index.mjs"]

Lots of examples without the entire OS as other comments mention, an example would be Googles distroless[0]

[0]: https://github.com/GoogleContainerTools/distroless

Docker doesn't do this all the time. Distroless Docker containers are relatively common. https://github.com/GoogleContainerTools/distroless

Deployment: https://github.com/GoogleContainerTools/distroless

Or use distroless image as it includes one, among others. https://github.com/GoogleContainerTools/distroless/blob/main/base/README.md