Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Minimus container images are now free

images.minimus.io

Post reply on HN
Print view View original

71–80 of 80 posts

Re: Minimus container images are now free

#71

Post by morellonet »

euph0ria wrote: post #68

Thank you for this! Super valuable for contribution to all businesses. Suppose I want to add a custom PHP extension such as NewRelic, how would I go about adding that on your distroless images?

Depends on your preferences but probably easiest approach is to take the -dev version of our PHP image and run a build from that to add whatever you need on top of that hardened base.

You can even do a multi step build if you want to use the fully minimalistic image at runtime. Details at https://docs.minimus.io/foundations/going-distroless

Re: Minimus container images are now free

#72

Post by danudey »

zufallsheld wrote: post #18
morellonet wrote: post #15

Earlier quoted context omitted.

Currently, yes free as in beer. We build every component directly from source in a SLSA 3 environment we run (mostly in GCP). Making the Dockerfiles available is a fair question, not something we’ve done thus far because it’s not particularly useful if you don’t have all the infrastructure building the components. Do you have particular scenarios you’d like the Dockerfiles for or is it just for transparency/ trust (w…

> Do you have particular scenarios you’d like the Dockerfiles for or is it just for transparency/ trust (which is a totally valid reason of course)? The latter. You or an attacker could tamper with the images - however even with the Dockerfiles I can't be sure that the provided images are built from the Dockerfiles, so in the end I'd have to trust you anyway. Also I'd be curious how you build the images. Thanks for y…

Would be nice to see logs from the CI runs building the images, to see the hashes of inputs and outputs. Useful, I guess unless the logs were tampered with also.

Re: Minimus container images are now free

#73

Post by morellonet »

indigodaddy wrote: post #67

I'm interested in using these images on exe.dev. exe supports any oci images and stands it up as a microvm, in which it would be used non-ephemerally from that point. I'm assuming the images don't have any rc/services. How hard would it be to pull that back in after image deployment? (Also looks like I'd want to use the -dev images which include shell/apk, etc)

Correct they do not have any rc

I’m not personally familiar with exe.dev but if it can run normal OCI images it should be pretty simple to use ours. If you want a shell and package manager and some common busybox applets, -dev variants are the best option.

Re: Minimus container images are now free

#74

Post by morellonet »

_def wrote: post #69
morellonet wrote: post #3

John here (CTO and Co-Founder)… we’d be happy to answer any questions anyone has!

What can you say about long-term plans? The bitnami situation burned a lot of people I think, and yes we can cache your images, but switching providers still does not come for free.

We did this because we believe this market is becoming more about the integration and enterprise capabilities rather than just selling the images. The more people know about, use, and benefit from the images the more potential Enterprise Edition customers we can help.

Re: Minimus container images are now free

#76

Post by philipbjorge »

morellonet wrote: post #24
charukiewicz wrote: post #23

Completely blocking the image information page to mobile user agents is completely unnecessary. I'd much rather look at your non optimized page than be told to come back on desktop. Moreover, even after switching to desktop mode on my phone, there's nothing I see that precludes you from employing a little bit of CSS to make those pages render more nicely on mobile screens.

Fair complaint. As with all software development we make tradeoffs to try to balance time and capability. I’ll make sure our front end lead see this though :)

I’ll second this, I had to send this message…

> based on our discussions so far, I think we’d only need... Which they appear to have but I can't dig in on mobile.

Re: Minimus container images are now free

#78

Post by x______________ »

morellonet wrote: post #24
charukiewicz wrote: post #23

Completely blocking the image information page to mobile user agents is completely unnecessary. I'd much rather look at your non optimized page than be told to come back on desktop. Moreover, even after switching to desktop mode on my phone, there's nothing I see that precludes you from employing a little bit of CSS to make those pages render more nicely on mobile screens.

Fair complaint. As with all software development we make tradeoffs to try to balance time and capability. I’ll make sure our front end lead see this though :)

> This page is currently not available for mobile devices. For the best experience, please visit us from your computer.

For what it's worth: my mobile device is a computer.

Re: Minimus container images are now free

#79

Post by csnoob »

morellonet wrote: post #53
alfanick wrote: post #45

Earlier quoted context omitted.

Maybe it's their business model? Sell to bunch of people and hook them in, then "get hacked", whoops sorry. Edit: honestly I'm flagging this post. This really looks like fishing for customers to make them vulnerable in future.

Not sure what you mean here. We have many enterprise customers, in industries including government, health care, financial services around the world. The whole value of the product is helping them avoid all the risk and work associated with poorly maintained container images. We publish a full SBOM for every image so you can see exactly what's inside of it. We've worked across the industry and OSS communities to enab…

How can we trust the image if we don't know what is inside? An sbom says what packages are installed but what is in the packages?

Alpine/debian packages show you the code that compiles the package from source, do you have that as well?

Re: Minimus container images are now free

#80

Post by briansioscl »

morellonet wrote: post #3

John here (CTO and Co-Founder)… we’d be happy to answer any questions anyone has!

Hello John, happy to hear that the image is free to the community, what a great contribution. May I know what is the underlying method to build the distroless image? Chainguard recently delete most of the cloud native application in their community repository, and I'm figuring how to get away from wolfi melange and apko. My closest bet is nix pkgs, but it would be great if you can share what you are using in Minimus :)
Post reply on HN