Closed Gontier-Julien closed 1 month ago
Adfditional comment on what the ldflags do:
-s disable symbol table
-w disable DWARF generation
-ldflags "-s -w"
I'm perfectly fine with this. Just make a PR and I'll be happy to merge it.
If you have strong space requirements you can even UPX the executables to trade cold start time for some (usually 50%) additional space savings (but I don't recommend doing this for everyone).
Disabling CGO
Disabling CGO is usually fine for most web applications in the wild, but this is a DNS server, and disabling CGO slightly changes how the DNS client in netgo behaves (from directly calling into the libc to mimicking the behavior in pure Go). This change has been causing unexpected problems all the time and I really don't recommend doing this.
And there will not be any libc version incompatibilities because we invented Docker to solve exactly this problem.
Starting from
scratch
This is another popular thing that I don't recommend. 3 reasons:
FROM image; RUN ...
. For example, it is now 10x harder to add dig
command to the container for health checks (this is a real use case: I deploy it in a cluster and have rolling updates).Starting from scratch
will save you at most a few megabytes, plus base image layers will be shared between images, so I personally feel it has more cons than pros.
Running as nobody
While running as non-root comes with some security defaults that makes the system slightly more secure, there are multiple problems:
There are modern ways to achieve the same security enhancements. Recommended:
docker run --cap-drop ...
to remove non-essential capabilities (our documentation does not have an example; if you have time, do help add an example here!)I'll make a pr now for the ldflags 👍🏻
Also other question since we at it, is the latest tag based on commit or latest stable version ?
Currently based on master, since the automated build is set up like 2 days ago and we don't have a tag newer than that yet. (Plus we don't have the correct GitHub workflow for a Git tag...)
Alright so when a new version will be up the will be a tag for it then? ^^
I guess this can be safely closed for now.
It just a proposal for now, but it being working perfectly, and i run it everyday with my own docker image.
Currently the docker image is build like this:
My proposition. To build the final image from 'scratch':
Advantage:
Disadvantage:
The image could be also made smaller by adding '-s -w' to the 'ldflags' like this:
I can make a pull request if your okay with those changes, but i just wanted to discuss it with you first ^^ I've been running my image for 9month straight with no issues on my side You can check my current docker image and GitHub for it.