𝗧𝗵𝗲 𝗺𝘂𝗹𝘁𝗶-𝘀𝘁𝗮𝗴𝗲 𝗯𝘂𝗶𝗹𝗱 𝗽𝗮𝘁𝘁𝗲𝗿𝗻 𝗶𝘀 𝗼𝗻𝗲 𝘁𝗵𝗮𝘁'𝘀 𝗱𝗲𝘀𝗶𝗴𝗻𝗲𝗱 𝘀𝗽𝗲𝗰𝗶𝗳𝗶𝗰𝗮𝗹𝗹𝘆 𝗳𝗼𝗿 𝗽𝗿𝗼𝗱𝘂𝗰𝘁𝗶𝗼𝗻 𝗿𝗲𝗮𝗱𝗶𝗻𝗲𝘀𝘀: • Omitting the development dependencies and the compilers hardens the security by minimizing potential vulnerabilities. • The final image contains only the compiled code and runtime dependencies, resulting with a drastically reduced image size; improving deployment speed and lowering attack surface, like Siad explained, while also making scaling easier because smaller images mean quicker pulls and less resource usage. 𝗺𝘂𝗹𝘁𝗶-𝘀𝘁𝗮𝗴𝗲 𝗯𝘂𝗶𝗹𝗱𝘀 𝗲𝘅𝗮𝗺𝗽𝗹𝗲: ---------------------------------------------- ꜰʀᴏᴍ ɴᴏᴅᴇ:20-ᴀʟᴘɪɴᴇ ᴀꜱ ʙᴜɪʟᴅᴇʀ ᴡᴏʀᴋᴅɪʀ /ᴀᴘᴘ ᴄᴏᴘʏ ᴘᴀᴄᴋᴀɢᴇ*.ᴊꜱᴏɴ ./ ʀᴜɴ ɴᴘᴍ ᴄɪ ᴄᴏᴘʏ . . ʀᴜɴ ɴᴘᴍ ʀᴜɴ ʙᴜɪʟᴅ ꜰʀᴏᴍ ɴᴏᴅᴇ:20-ᴀʟᴘɪɴᴇ ᴀꜱ ᴘʀᴏᴅᴜᴄᴛɪᴏɴ ᴡᴏʀᴋᴅɪʀ /ᴀᴘᴘ ᴄᴏᴘʏ ᴘᴀᴄᴋᴀɢᴇ*.ᴊꜱᴏɴ ./ ʀᴜɴ ɴᴘᴍ ᴄɪ --ᴏᴍɪᴛ=ᴅᴇᴠ ᴄᴏᴘʏ --ꜰʀᴏᴍ=ʙᴜɪʟᴅᴇʀ /ᴀᴘᴘ/ᴅɪꜱᴛ ./ᴅɪꜱᴛ ᴄᴍᴅ ["ɴᴏᴅᴇ", "ᴅɪꜱᴛ/ᴀᴘɪ/ɪɴᴅᴇx.ᴊꜱ"] ---------------------------------------------- Notice how the fresh image for production runtime omits dev/test tools, copies only the compiled output from the builder stage by referencing its alias. #Docker #NodeJS #DevOps #ProductionReady #CloudSecurity #CICD #ScalableSystems #LearningInPublic
Your containers are carrying large amounts of bloat eating away at your budget, But no-one at work talks about it, because "it works". However, it's a bottleneck in every part of your deployment process. > Build & deployment times are higher. > Scans/tests run for longer. > Threat surfaces expand. Just one tweak can change all of this though. Multistage builds. This is exactly what happened during my oversight of a microservices platform. > Images went from 99MB -> just 5MB. > Disk usage went from 462MB -> 16MB. Have a read of my blog below on it, where I shared more details 👇 . ------- ♻️ Share if helpful #devops #docker #containers