Skip to content

refactor: Docker (Alpine) improvements - #2752

Merged
drwetter merged 2 commits into
testssl:3.2from
polarathene:patch-1
May 5, 2025
Merged

drwetter merged 2 commits into
testssl:3.2from
polarathene:patch-1

Conversation

@polarathene

@polarathene polarathene commented May 1, 2025 •

Copy link
Copy Markdown
Contributor

Describe your changes

Applying changes that I detailed in this comment.

Alpine image size reduced from 60MB (technically 52MB) to 36MB (dist-git) or 28MB (dist-local).

Change overview:

  • Alpine version bump 3.20 => 3.21
  • Removed WORKDIR /home/testssl to be consistent with the main Dockerfile which leaves working directory at default /.
  • apk update is not needed, if run with --no-cache in a separate RUN it has no layer weight. Removing it or adding --no-cache reduces weight by 2MB.
  • Removed git package + git clone command, no longer necessary. Reduces weight by 14MB+
  • Removed mkdir -m 755 -p /home/testssl/etc /home/testssl/bin, these already exist with expected permissions via the clone.
  • ARG renamed and relocated to end of file at the dist-git stage. Technically a breaking change, perhaps the ARG names should be kept the same?
  • Added a dist-local stage that uses COPY for a local clone like the main Dockerfile does (reduces weight by 8MB). While dist-git stage uses ADD to perform a remote git clone.

Some of these changes were attempted back in Feb 2023 for Dockerfile (when it was still Alpine based). That PR provides additional information to support these changes

  • Such as apk add --no-cache implying apk update.
  • A slight regression by removing git package and .git/ dir which loses the git log feature to identify testssl.sh version via commit hash.

Related caveat with Alpine image in the past was incompatibility with the OpenSSL bins (glibc) that are copied over into the image, since even with a static glibc build, glibc static is known to have compatibility caveats when it comes to DNS logic (looking through issue history on DNS / getaddrinfo, there was since talk about segfaults that required a newer static compile that resolved it, so maybe not a DNS musl issue at these linked comments):

What is your pull request about?

  • Improvement

60MB => 38MB (dist-git) or 30MB (dist-local)
Comment thread Dockerfile.git Resolved
@polarathene

polarathene commented May 1, 2025 •

Copy link
Copy Markdown
Contributor Author

This effectively makes Dockerfile.git an alternative build with Alpine for those that want a smaller release.

You could rename this Dockerfile.alpine and have the CI build and publish it with a -alpine suffix? (Usual convention when supporting more than one base distro)

@drwetter

drwetter commented May 2, 2025

Copy link
Copy Markdown
Collaborator

Thx, @polarathene . We have a long weekend here --> next week

@drwetter
drwetter merged commit 252cee6 into testssl:3.2 May 5, 2025
@drwetter

drwetter commented May 5, 2025

Copy link
Copy Markdown
Collaborator

Thanks @polarathene !

image

The top two are the old an new alpine images, based on (the to be renamed) Dockerfile.git

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants