fides icon indicating copy to clipboard operation
fides copied to clipboard

Minimize production Docker image

Open daveqnet opened this issue 3 years ago • 0 comments

Is your feature request related to a specific problem?

  • There are packages e.g. vim included in the current fidesctl image that are not strictly necessary for the application to function. Aside from image bloat, this is a security risk. An attacker can't exploit what isn't included (attack surface reduction).

Describe the solution you'd like

  • Identify the essential packages that need to be included in a production image.
  • Modify the build process to include strictly essential packages & files in the production image.

Describe alternatives you've considered, if any

n/a

Additional context

  • This issue also applies to fidesops, but I haven't created a separate issue for it.
  • Dev images can be bloated. Indeed, they should be optimized for build speed, not size.
  • Multi-stages builds might help, but are of limited use for Python application images.
  • Moving from Debian to Alpine as a base image is probably a dead end. Build durations would mushroom (alienating devs) and musl libc is problematic (no wheels).
  • Some basic tips

daveqnet avatar Jul 22 '22 14:07 daveqnet