ritvikarya98

I think it depends on your use case, an image can be as small as default static, but if you need more, we need to add packages. Minimal images make sure we do that with least attack surface.

Hi thanks for looking - I would preferably more info on your setup, but this is similar to using any container image. Currently all the tags are latest and if you have that setup you would pick that up from this repo and pretty sure this can be automated.

Thanks! but these are builder images, not the final runtime. Chisel only really makes sense after the binary is built and you know what it needs at runtime. Before that you are pulling in whole packages, which is why things like ncurses might show up, similar to chainguard's image. For a builder, it is just SBOM noise and not something the app ever executes. Its hard to identify what you need before running the application, and you can always find a library you don't need. The “only your app should be executable” idea works for fully static binaries, but once you use glibc or CGO you already have other executables.

Some images do overlap yes, but they are some of the most popular ones used and I wanted to demonstrate how they can be build as well. Half of them are only available through paid versions. I will be adding new images on regular basis, based on usage and impact.

Thanks for looking into this! I agree with you and hence I'm also relying on Wolfi packages, which will ensure they are updated as soon as upstream is available so I'm piggy backing on that. Github Actions run daily/weekly based on the cadence and once the pipeline is setup do not require a significant effort imo. And I want it to be community driven so we can add images as and when people want it and build it accordingly. Chainguard tools surely help with this! I aim to show that companies can try and build internal pipelines like this for all images in their repository

Presenting doccopy for anyone playing around with containers. This tool creates a new container which is a clone/duplicate of the input container. It can be useful for anyone trying to run multiple containers for perform a task and instead use this.