Building Minimal Docker Containers Orangesys Inc.

$Who am I Orangesys Inc. Tachibana Shuji Twitter @yepn Running

Orangesys Inc. SaaS監視システム https://orangesys.io @orangesysio

No content

No content

Orangesys ● All in docker ● Kubernetes on GKE ● OpsDev -> NoOps Architecture & Stack

Architecture: Orangesys > Kubernetes Apigateway Namespace Cloud Load Balancing Standard Devices HTTPS Browser Client Production Namespace Kube-system Namespace Tiller Replication Controller Grafana Container Engine Replication Controller Influxdb Container Engine Replication Controller Corporate Site App Engine Autoscaling Orangesys Firebase Autoscaling Monitoring Namespace Prometheus RC Influxdb RC Grafana RC Opsbot Namespace Kubebot RC K8s-event RC Stripe Server Api Container Engine Replication Controller PostgresSQL Container Engine Replication Controller MariaDb Container Engine Replication Controller Nginx Container Engine Replication Controller Traefik Container Engine Replication Controller Server Telegraf Ingress Container Engine Replication Controller Kong ApiGateway Container Engine Replication Controller Kubenetes API Replication Controller SSL Cert Bot Replication Controller Orange Api Container Engine Replication Controller

Technology Stack

Agenda ● Docker images size ● Docker images security

No content

Coreos clair Security data Sources

Layers

Topic Alpineでdocker image Goalngなら、scratchベースでdocker imageを作る Layersを減らすと、build時間が短縮

Alpine base image base size 2MBのAlpineでdocker imageを作る、 ただし LIBCがMUSL LIBCとなりましたが、OS周りの依頼関係 ex) Not resolving using search domain ..svc.cluster.local https://github.com/gliderlabs/docker-alpine/issues/8

Scratch base image Goalngなら、scratchベースでdocker imageを作る ただし コンテナから外部へhttps通信時、ca証明書の実装が必要となります。 FROM scratch ADD ca-certificates.crt /etc/ssl/certs/ ADD main / CMD ["/main"]

Layers Layersを減らすと、build時間が短縮 ただし、LIBCを使う場合は、既存のdocker imagesを利用した方が良いかも

参考 https://github.com/orangesys https://stackshare.io/orangesys-inc https://hub.docker.com/u/orangesys/dashboard/