{"action":"created","issue":{"url":"https://api.github.com/repos/envoyproxy/envoy/issues/5325","repository_url":"https://api.github.com/repos/envoyproxy/envoy","labels_url":"https://api.github.com/repos/envoyproxy/envoy/issues/5325/labels{/name}","comments_url":"https://api.github.com/repos/envoyproxy/envoy/issues/5325/comments","events_url":"https://api.github.com/repos/envoyproxy/envoy/issues/5325/events","html_url":"https://github.com/envoyproxy/envoy/issues/5325","id":391592244,"node_id":"MDU6SXNzdWUzOTE1OTIyNDQ=","number":5325,"title":"Runtime Docker image improvements","user":{"login":"JayH5","id":1748643,"node_id":"MDQ6VXNlcjE3NDg2NDM=","avatar_url":"https://avatars3.githubusercontent.com/u/1748643?v=4","gravatar_id":"","url":"https://api.github.com/users/JayH5","html_url":"https://github.com/JayH5","followers_url":"https://api.github.com/users/JayH5/followers","following_url":"https://api.github.com/users/JayH5/following{/other_user}","gists_url":"https://api.github.com/users/JayH5/gists{/gist_id}","starred_url":"https://api.github.com/users/JayH5/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JayH5/subscriptions","organizations_url":"https://api.github.com/users/JayH5/orgs","repos_url":"https://api.github.com/users/JayH5/repos","events_url":"https://api.github.com/users/JayH5/events{/privacy}","received_events_url":"https://api.github.com/users/JayH5/received_events","type":"User","site_admin":false},"labels":[{"id":421403909,"node_id":"MDU6TGFiZWw0MjE0MDM5MDk=","url":"https://api.github.com/repos/envoyproxy/envoy/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"open","locked":false,"assignee":{"login":"JayH5","id":1748643,"node_id":"MDQ6VXNlcjE3NDg2NDM=","avatar_url":"https://avatars3.githubusercontent.com/u/1748643?v=4","gravatar_id":"","url":"https://api.github.com/users/JayH5","html_url":"https://github.com/JayH5","followers_url":"https://api.github.com/users/JayH5/followers","following_url":"https://api.github.com/users/JayH5/following{/other_user}","gists_url":"https://api.github.com/users/JayH5/gists{/gist_id}","starred_url":"https://api.github.com/users/JayH5/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JayH5/subscriptions","organizations_url":"https://api.github.com/users/JayH5/orgs","repos_url":"https://api.github.com/users/JayH5/repos","events_url":"https://api.github.com/users/JayH5/events{/privacy}","received_events_url":"https://api.github.com/users/JayH5/received_events","type":"User","site_admin":false},"assignees":[{"login":"JayH5","id":1748643,"node_id":"MDQ6VXNlcjE3NDg2NDM=","avatar_url":"https://avatars3.githubusercontent.com/u/1748643?v=4","gravatar_id":"","url":"https://api.github.com/users/JayH5","html_url":"https://github.com/JayH5","followers_url":"https://api.github.com/users/JayH5/followers","following_url":"https://api.github.com/users/JayH5/following{/other_user}","gists_url":"https://api.github.com/users/JayH5/gists{/gist_id}","starred_url":"https://api.github.com/users/JayH5/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JayH5/subscriptions","organizations_url":"https://api.github.com/users/JayH5/orgs","repos_url":"https://api.github.com/users/JayH5/repos","events_url":"https://api.github.com/users/JayH5/events{/privacy}","received_events_url":"https://api.github.com/users/JayH5/received_events","type":"User","site_admin":false}],"milestone":null,"comments":5,"created_at":"2018-12-17T07:45:27Z","updated_at":"2018-12-17T18:33:55Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"*Title*: Improvements to the runtime Docker images\r\n\r\n*Description*:\r\nThis is a tracking issue for proposed improvements to the runtime Docker images for Envoy. I spoke to Matt briefly at EnvoyCon and he told me there isn't really a single person responsible for the Docker images and that contributions would be welcome.\r\n\r\nWhile there isn't anything critically wrong with the existing images, I think they could be refined in some ways. Spinning up an Envoy Docker container is probably one of the most common ways that people first interact with Envoy, so it is important that they work well. And while it seems like few of the companies that are core users of Envoy use these Docker images in production (e.g. Lyft uses binaries, not Docker), some popular downstream projects (e.g. Heptio Contour) do.\r\n\r\nThe [`docker-library/official-images` repo](https://github.com/docker-library/official-images) where the majority of the top-level Docker images (e.g. `FROM ubuntu`, `FROM golang`) are built from provides some [guidelines](https://github.com/docker-library/official-images#review-guidelines) for image best practices. While the Envoy project may not want to use _all_ of those guidelines, I think they provide a good starting point. I've also worked a bit on some of the \"official images\" (mostly the Python one) and so am familiar with how things are done there.\r\n\r\nSome initial work could be:\r\n- [ ] Add a simple entrypoint script (as shown in the official-images guide)\r\n- [ ] Ensure no unnecessary packages are in the images (i.e. the images are \"minimal\")\r\n- [ ] Ensure all images are based on official or reasonably official images (e.g. the Alpine image is currently based on a community-maintained image with glibc for Alpine--is this ok?) and not the `latest` tags.\r\n- [ ] Provide a simple way to run Envoy as a non-root user\r\n- [ ] Consistent story around configuration with environment variables (e.g. there's a `$loglevel` variable that is quite ad-hoc and in a lot of cases probably unused).\r\n\r\nSome further work could be:\r\n- Add some basic tests?\r\n- Improve the [build process](https://github.com/envoyproxy/envoy/blob/890f1f13179e74d4b728599da66466acf0338762/ci/do_ci.sh#L43-L48)?\r\n- Move to Ubuntu 18.04 base?\r\n- Use more of Bazel's Docker build tools ([`rules_docker`](https://github.com/bazelbuild/rules_docker))?\r\n- Run security scans against images?\r\n- Get images published as part of the \"official images\"?\r\n\r\nThese are just some suggestions and can, of course, be changed. As of writing, I haven't run these by anybody yet, but I thought it best just to get the ball rolling. I'll open a PR or two to start.\r\n\r\nNote that this issue is just about the runtime images for now. I haven't looked into the build image yet but could work on that eventually as well if there's interest.\r\n\r\n*Relevant Links*:\r\n[`docker-library/official-images` review guidelines](https://github.com/docker-library/official-images#review-guidelines)\r\nPR #2850 (seems like the last attempt at something like this), and corresponding issue which is very similar: #2805\r\n"},"comment":{"url":"https://api.github.com/repos/envoyproxy/envoy/issues/comments/447950216","html_url":"https://github.com/envoyproxy/envoy/issues/5325#issuecomment-447950216","issue_url":"https://api.github.com/repos/envoyproxy/envoy/issues/5325","id":447950216,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0Nzk1MDIxNg==","user":{"login":"JayH5","id":1748643,"node_id":"MDQ6VXNlcjE3NDg2NDM=","avatar_url":"https://avatars3.githubusercontent.com/u/1748643?v=4","gravatar_id":"","url":"https://api.github.com/users/JayH5","html_url":"https://github.com/JayH5","followers_url":"https://api.github.com/users/JayH5/followers","following_url":"https://api.github.com/users/JayH5/following{/other_user}","gists_url":"https://api.github.com/users/JayH5/gists{/gist_id}","starred_url":"https://api.github.com/users/JayH5/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JayH5/subscriptions","organizations_url":"https://api.github.com/users/JayH5/orgs","repos_url":"https://api.github.com/users/JayH5/repos","events_url":"https://api.github.com/users/JayH5/events{/privacy}","received_events_url":"https://api.github.com/users/JayH5/received_events","type":"User","site_admin":false},"created_at":"2018-12-17T18:33:55Z","updated_at":"2018-12-17T18:33:55Z","author_association":"CONTRIBUTOR","body":"@moderation ah there seems to be a bitnami image for everything 😅. Those do look good and conceptually (and size-wise) similar to the slim Debian images. For Envoy, _technically_ all we need is an image with glibc and a CA cert bundle, so even something like [`distroless/base`](https://github.com/GoogleContainerTools/distroless/tree/master/base) could work too...\r\n\r\n> A lot of people (including me) roll our own container image to meet company requirements.\r\n\r\nI'd be interested in hearing more about these requirements and whether some of them could be satisfied in the official image?"}}
{"actor":{"display_login":"JayH5"}}