Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using multi-arch Docker images to support apps on any architecture

mirailabs.io

Post reply on HN
Print view View original

21–30 of 41 posts

Re: Using multi-arch Docker images to support apps on any architecture

#21

Post by ericb »

gravypod wrote: post #20
ericb wrote: post #19

Anyone know how to get smaller docker images? I thought if I had all the previous layers in the docker registry that an upload would just be the size of the diff of the new layer, but this seems to never work.

Some docker registries isolate the layer cache per account to prevent cache poisoning attacks and data leaks. This means you might only take advantage of the registry caching if you have already pushed the first version of a tagged image. If you want to get extremely small docker images you might also want to take a look at Google's distroless images and using mutlistage builds.

> Some docker registries isolate the layer cache per account to prevent cache poisoning attacks and data leaks.

Are there ones that don't that you know of? This will be for an intranet registry, so the isolation doesn't buy much.

Thanks! re:the other suggestions, I will look into those.

Re: Using multi-arch Docker images to support apps on any architecture

#22

Post by hinkley »

ericb wrote: post #19

Anyone know how to get smaller docker images? I thought if I had all the previous layers in the docker registry that an upload would just be the size of the diff of the new layer, but this seems to never work.

If you can get all of your images on the same machine to use the same base, you’ll get somewhere. Being careful of layer order, using a script to run the most disk-intensive layers also helps.

I’m having okay luck with alpine base images right now, but app versions are less flexible.

Re: Using multi-arch Docker images to support apps on any architecture

#23

Post by gravypod »

ericb wrote: post #21
gravypod wrote: post #20

Earlier quoted context omitted.

Some docker registries isolate the layer cache per account to prevent cache poisoning attacks and data leaks. This means you might only take advantage of the registry caching if you have already pushed the first version of a tagged image. If you want to get extremely small docker images you might also want to take a look at Google's distroless images and using mutlistage builds.

> Some docker registries isolate the layer cache per account to prevent cache poisoning attacks and data leaks. Are there ones that don't that you know of? This will be for an intranet registry, so the isolation doesn't buy much. Thanks! re:the other suggestions, I will look into those.

GCR boasts it has a global layer cache. Also, this is a thing that should only ever effect your very first push. You should only be seeing it twice if:

1. None of your image layers are the same between builds (ADD as one of the first instructions for instance)

2. You are distributing your code to many people and they are building them into entirely separate accounts. (you send me your code and I build, tag, and push it to my dockerhub account).

Re: Using multi-arch Docker images to support apps on any architecture

#24

Post by ericb »

gravypod wrote: post #23
ericb wrote: post #21

Earlier quoted context omitted.

> Some docker registries isolate the layer cache per account to prevent cache poisoning attacks and data leaks. Are there ones that don't that you know of? This will be for an intranet registry, so the isolation doesn't buy much. Thanks! re:the other suggestions, I will look into those.

GCR boasts it has a global layer cache. Also, this is a thing that should only ever effect your very first push. You should only be seeing it twice if: 1. None of your image layers are the same between builds (ADD as one of the first instructions for instance) 2. You are distributing your code to many people and they are building them into entirely separate accounts. (you send me your code and I build, tag, and push…

Unfortunately, choice 2 sounds like us. I was looking for some way to short-circuit that (by maybe shipping the repo already loaded) as the product runs in the customer's cloud, and the images are built on their machines.

Re: Using multi-arch Docker images to support apps on any architecture

#25

Post by takeda »

gravypod wrote: post #17
Ericson2314 wrote: post #15

Earlier quoted context omitted.

Please go to NixOS.org. The Nix package manager, Nixpkgs package set, and NixOS distribution is exactly what you want.

Nix, similar to Bazel, Buck, Pants, and Please are very close to what I'd like but doesn't cover the exact functionality I'm looking for.

What functionality are you missing?

Re: Using multi-arch Docker images to support apps on any architecture

#27

Post by gravypod »

takeda wrote: post #25
gravypod wrote: post #17

Earlier quoted context omitted.

Nix, similar to Bazel, Buck, Pants, and Please are very close to what I'd like but doesn't cover the exact functionality I'm looking for.

What functionality are you missing?

Being built on standardized container technology. Also support for Windows builds would be nice.

Re: Using multi-arch Docker images to support apps on any architecture

#28

Post by shaklee3 »

gravypod wrote: post #3

I wish there was something like Bazel, Buck, Pants, or Please built on top of docker/crio. The docker build cache, and dockerizarion of tools, has made building, testing, and deploying software so much simpler. Unfortunately the next step in build systems (in my opinion) still has the mentality that people want to have mutable state on their host systems. I hope someone extends BuildKit into a system like Bazel. All…

This is kind of what skaffold does. Check it out if you haven't.

Re: Using multi-arch Docker images to support apps on any architecture

#30

Post by jraph »

steventhedev wrote: post #29

As an aside, is this the new pipe curl to sudo bash? docker run --rm --privileged docker/binfmt:66f9012c56a8316f9244ffd7622d7c21c1f6f28d

Except you cannot even look at the contents of the file being piped beforehand and hope that the same file is downloaded when you actually pipe it. It's more like running setup.exe using the administrator account.
Post reply on HN