I am pushing myself to learn nix and get rid of base images altogether.
The syntax is hard without a functional background but I strongly believe this is the next logical step to harden containers and have reproducible builds.
Show HN: Minimal – Open-Source Community driven Hardened Container Images
31–33 of 33 posts
Re: Show HN: Minimal – Open-Source Community driven Hardened Container Images
#32Why does this not use chisel? I assume you at least drop the bin dir? Although the presence of ncurses is super weird I don't understand why one would go halfway and leave packages which are unneeded for services. The only executable in a hardened container image should be your application.
Thanks! but these are builder images, not the final runtime. Chisel only really makes sense after the binary is built and you know what it needs at runtime. Before that you are pulling in whole packages, which is why things like ncurses might show up, similar to chainguard's image. For a builder, it is just SBOM noise and not something the app ever executes. Its hard to identify what you need before running the appli…
Then why are these labelled as "production" ready?
And surely redis is a runtime image?
Re: Show HN: Minimal – Open-Source Community driven Hardened Container Images
#33This is pretty useful in my opinion - atleast now I know a way to build hardened images on my own1