fides
fides copied to clipboard
Minimize production Docker image
Is your feature request related to a specific problem?
- There are packages e.g. vim included in the current fidesctl image that are not strictly necessary for the application to function. Aside from image bloat, this is a security risk. An attacker can't exploit what isn't included (attack surface reduction).
Describe the solution you'd like
- Identify the essential packages that need to be included in a production image.
- Modify the build process to include strictly essential packages & files in the production image.
Describe alternatives you've considered, if any
n/a
Additional context
- This issue also applies to fidesops, but I haven't created a separate issue for it.
- Dev images can be bloated. Indeed, they should be optimized for build speed, not size.
- Multi-stages builds might help, but are of limited use for Python application images.
- Moving from Debian to Alpine as a base image is probably a dead end. Build durations would mushroom (alienating devs) and musl libc is problematic (no wheels).
- Some basic tips